sig-auth review: comment on code #162

ibihim · 2022-02-17T15:39:19Z

Signed-off-by: Krzysztof Ostrowski [email protected]

Signed-off-by: Krzysztof Ostrowski <[email protected]>

deads2k · 2022-02-17T16:30:10Z

main.go

-	flagset.AddGoFlagSet(klogFlags)
-
-	// kube-rbac-proxy flags
-	flagset.StringVar(&cfg.insecureListenAddress, "insecure-listen-address", "", "The address the kube-rbac-proxy HTTP server should listen on.")


going top to bottom, this is weird. Why would a process consuming tokens allow non-tls access? The kube-apiserver, kube-controller-manager, etc listen on tls and allow unauthenticated access to readyz for LBs.

TODO: pre-acceptance, eliminate the ability to use cleartext tokens.

@s-urbaniak, can we remove the insecure-listen-address in the release after next?

historically this was made a separate setting in 904be98.

I do agree this is dangerous territory. insecure listening is maybe just useful for debugging. I am fine with removing it. We should make it clear though that this is a breaking change.

@deads2k, we are only focused on removing an insecure listen address for kube-rbac-proxy, but do we want to continue support for an upstream H2C?

@deads2k, we are only focused on removing an insecure listen address for kube-rbac-proxy, but do we want to continue support for an upstream H2C?

I'm ok allowing an http backend as long as we are not asserting identity to it. If identity is asserted, then the connection should be https.

deads2k · 2022-02-17T16:31:53Z

main.go

-	flagset.StringVar(&cfg.tls.keyFile, "tls-private-key-file", "", "File containing the default x509 private key matching --tls-cert-file.")
-	flagset.StringVar(&cfg.tls.minVersion, "tls-min-version", "VersionTLS12", "Minimum TLS version supported. Value must match version names from https://golang.org/pkg/crypto/tls/#pkg-constants.")
-	flagset.StringSliceVar(&cfg.tls.cipherSuites, "tls-cipher-suites", nil, "Comma-separated list of cipher suites for the server. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). If omitted, the default Go cipher suites will be used")
-	flagset.DurationVar(&cfg.tls.reloadInterval, "tls-reload-interval", time.Minute, "The interval at which to watch for TLS certificate changes, by default set to 1 minute.")


minor: k8s.io/apiserver auto-reloads these now if this depended on that.

TODO: post-acceptance, this needs to be updated.

No, this is for the raw go http proxy server cert/key reload and not dependent on k8s.io/apiserver.

However, we can investigate if k8s.io/apiserver proxy code can be reused 👍

deads2k · 2022-02-17T16:33:29Z

main.go

-
-	// Auth flags
-	flagset.StringVar(&cfg.auth.Authentication.X509.ClientCAFile, "client-ca-file", "", "If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.")
-	flagset.BoolVar(&cfg.auth.Authentication.Header.Enabled, "auth-header-fields-enabled", false, "When set to true, kube-rbac-proxy adds auth-related fields to the headers of http requests sent to the upstream")


Where can I configure the client cert/key pair used to identify the kube-rbac proxy to the upstream when setting these headers?

TODO: pre-acceptance, if kube-rbac is a front-proxy, it must have a client-certificate so that the server it proxies to can confirm it is the kube-rbac-proxy.

The TLS config can be specified here.
It is used here to specify tls.Config.

If no TLS cert / key is provided, is creates a self-signed one.

The TLS config can be specified here.
It is used here to specify tls.Config.

If no TLS cert / key is provided, is creates a self-signed one.

Those are serving certificates, but not client certificates

yes, agreed, this flag should gain additional client-cert/key parameters. My only historical guess why this is currently as is:

upstream and kube-rbac-proxy are always running in the same pod

upstream listens (usually) on localhost only

hence, a rogue client would have to enter the pod's network namespace to execute rogue requests

if a malicious client can enter pod's network namespace, it can most likely also enter the pod's mount namespace and introspect configures client certs/keys

anyways, definitely a good and necessary addition 👍

deads2k · 2022-02-17T16:34:46Z

main.go

-	flagset.StringVar(&cfg.auth.Authentication.Header.UserFieldName, "auth-header-user-field-name", "x-remote-user", "The name of the field inside a http(2) request header to tell the upstream server about the user's name")
-	flagset.StringVar(&cfg.auth.Authentication.Header.GroupsFieldName, "auth-header-groups-field-name", "x-remote-groups", "The name of the field inside a http(2) request header to tell the upstream server about the user's groups")
-	flagset.StringVar(&cfg.auth.Authentication.Header.GroupSeparator, "auth-header-groups-field-separator", "|", "The separator string used for concatenating multiple group names in a groups header field's value")
-	flagset.StringSliceVar(&cfg.auth.Authentication.Token.Audiences, "auth-token-audiences", []string{}, "Comma-separated list of token audiences to accept. By default a token does not have to have any specific audience. It is recommended to set a specific audience.")


This default means that a kube-apiserver token would be accepted by this proxy? This looks like a risky default.

Yes, this is what it does.

@deads2k do you mind to elaborate? I recall clayton also mentioned this during the sig-auth call, but I honestly don't remember 😬

deads2k · 2022-02-17T16:35:38Z

main.go

-	flagset.DurationVar(&cfg.tls.reloadInterval, "tls-reload-interval", time.Minute, "The interval at which to watch for TLS certificate changes, by default set to 1 minute.")
-
-	// Auth flags
-	flagset.StringVar(&cfg.auth.Authentication.X509.ClientCAFile, "client-ca-file", "", "If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.")


Will this default to the in-cluster value if unset?

TODO: answer and we'll decide

No, I does not. It uses the DelegatingAuthenticatorConfig that only verifies the client-ca, if it is given (link).

That's a pain.

@deads2k what would be a sensible in-cluster location?

@deads2k what would be a sensible in-cluster location?

it's stored in a configmap in kube-public namespace

Post acceptance, but strongly recommended.

deads2k · 2022-02-17T16:37:14Z

main.go

-	flagset.StringVar(&cfg.upstream, "upstream", "", "The upstream URL to proxy to once requests have successfully been authenticated and authorized.")
-	flagset.BoolVar(&cfg.upstreamForceH2C, "upstream-force-h2c", false, "Force h2c to communiate with the upstream. This is required when the upstream speaks h2c(http/2 cleartext - insecure variant of http/2) only. For example, go-grpc server in the insecure mode, such as helm's tiller w/o TLS, speaks h2c only")
-	flagset.StringVar(&cfg.upstreamCAFile, "upstream-ca-file", "", "The CA the upstream uses for TLS connection. This is required when the upstream uses TLS and its own CA certificate")
-	flagset.StringVar(&configFileName, "config-file", "", "Configuration file to configure kube-rbac-proxy.")


This is the authorization config, distinct from the authentication config?

TODO: pre-acceptance, update developer comments and command-line help

Yes, the config file is authz only. Authentication is handled by flags. Might have grown organically in time.

The pre-acceptance task is to update documentation in CLI and README, not the uniform handling of configuration options, right?

The pre-acceptance task is to update documentation in CLI and README, not the uniform handling of configuration options, right?

correct. Ideally with links to where I can see what format I've got here. I couldn't tell what this was without reading the code.

deads2k · 2022-02-17T16:39:25Z

main.go

-		// Force http/2 for connections to the upstream i.e. do not start with HTTP1.1 UPGRADE req to
-		// initialize http/2 session.
-		// See https://github.com/golang/go/issues/14141#issuecomment-219212895 for more context
-		proxy.Transport = &http2.Transport{


Flag for more eyes.

deads2k · 2022-02-17T16:43:39Z

main.go

-			} else {
-				klog.Info("Reading certificate files")
-				ctx, cancel := context.WithCancel(context.Background())
-				r, err := rbac_proxy_tls.NewCertReloader(cfg.tls.certFile, cfg.tls.keyFile, cfg.tls.reloadInterval)


note: find this package.

note: find this package.

prefer the k8s.io/apiserver package that does this.

https://github.com/kubernetes/apiserver/blob/master/pkg/server/dynamiccertificates/dynamic_serving_content.go#L57

deads2k · 2022-03-24T17:16:00Z

pkg/authz/auth.go

-	}
-	authorizerConfig := authorizerfactory.DelegatingAuthorizerConfig{
-		SubjectAccessReviewClient: client,
-		AllowCacheTTL:             5 * time.Minute,


What is the kube default allow and deny TTL.

TODO: post-acceptance, make this configurable with flags matching k8s.io/apiserver and have the defaults match.

It is 5 * time.Minute / 30 * time.Second: https://github.com/kubernetes/kubernetes/blob/442574f3a7321ff0f34dec9bae67f28651dbabd2/pkg/kubelet/apis/config/v1beta1/defaults.go#L87

But this doesn't make that much sense to use some kubelet defaults.
This looks more appropriate: 10 * time.Second.

https://github.com/kubernetes/kubernetes/blob/3ffdfbe286ebcea5d75617da6accaf67f815e0cf/staging/src/k8s.io/apiserver/pkg/server/options/authorization.go#L79-L95

deads2k · 2022-03-24T17:19:03Z

pkg/authz/auth.go

-		userName = a.GetUser().GetName()
-	}
-
-	if isAllowed(saConfig.User.Name, userName) &&


Allowing an empty username (and really any field) in the file to match all users looks like a recipe for "mispelled a value and now any user can do this!"

TODO: post-acceptance, start a path to have a safe (non-matching) default and migrate with warnings, flags, and forced changes.

explicitly using a "*" instead is safer and doesn't match valid names.

deads2k · 2022-03-24T17:21:09Z

pkg/authz/auth.go

-	config []StaticAuthorizationConfig
-}
-
-func (saConfig StaticAuthorizationConfig) Equal(a authorizer.Attributes) bool {


minor: this looks more like Matches than Equal

deads2k · 2022-03-24T17:21:59Z

pkg/authz/auth.go

-
-func NewStaticAuthorizer(config []StaticAuthorizationConfig) (*staticAuthorizer, error) {
-	for _, c := range config {
-		if c.ResourceRequest != (c.Path == "") {


post-acceptance, validate this in an explicit "validate user input" stage in addition to having it here. That change matches the upstream k/k structure

deads2k · 2022-03-24T17:24:01Z

pkg/authz/auth_test.go

-	"k8s.io/apiserver/pkg/authorization/authorizer"
-)
-
-func TestStaticAuthorizer(t *testing.T) {


missing wildcard non-resource checks?

deads2k · 2022-03-24T17:24:33Z

pkg/authz/auth_test.go

-	"k8s.io/apiserver/pkg/authorization/authorizer"
-)
-
-func TestStaticAuthorizer(t *testing.T) {


missing multiple path non-resource requests. /heathz/detailedfailure for instance. Positive and negative.

deads2k · 2022-03-24T17:27:09Z

pkg/authn/delegating.go

-
-	authenticatorConfig := authenticatorfactory.DelegatingAuthenticatorConfig{
-		Anonymous:               false, // always require authentication
-		CacheTTL:                2 * time.Minute,


What are the k8s.io/apiserver defaults

TODO: post-acceptance, path to make defaults match.

Seems like 10 * time.Second.

https://github.com/kubernetes/kubernetes/blob/75b19b242c34f7c1d1545e156f802f0a06b90533/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go#L207-L220

deads2k · 2022-03-24T17:29:19Z

pkg/proxy/proxy.go

-}
-
-// New creates an authenticator, an authorizer, and a matching authorizer attributes getter compatible with the kube-rbac-proxy
-func New(client clientset.Interface, config Config, authorizer authorizer.Authorizer, authenticator authenticator.Request) (*kubeRBACProxy, error) {


error is always nil.

clientset.Interface is also not used. lol

deads2k · 2022-03-24T17:31:03Z

pkg/proxy/proxy.go

-
-type kubeRBACProxy struct {
-	// authenticator identifies the user for requests to kube-rbac-proxy
-	authenticator.Request


minor: prefer not directly embedding types.

deads2k · 2022-03-24T17:34:27Z

pkg/proxy/proxy.go

-	}
-
-	// Authenticate
-	u, ok, err := h.AuthenticateRequest(req)


this does not appear to match kube filters.WithAuthentication. What is different and can we use the upstream filter

The authenticator.Request interface is at the core of filters.WithAuthentication.
The biggest difference is that there are no metrics taken and that the audience check happens in the DelegatingAuthenticatorConfig part.

TODO: pre-acceptance, collapse onto upstream for consistency.

deads2k · 2022-03-24T17:36:10Z

pkg/proxy/proxy.go

-func (h *kubeRBACProxy) Handle(w http.ResponseWriter, req *http.Request) bool {
-	ctx := req.Context()
-	if len(h.Config.Authentication.Token.Audiences) > 0 {
-		ctx = authenticator.WithAudiences(ctx, h.Config.Authentication.Token.Audiences)


not seeing where this is checked yet. Where is it? Can we match kube and do it during authentication.

The Audiences are used for the DelegatingAuthenticatorConfig. This leverages kubernetes logic.

deads2k · 2022-03-24T17:37:49Z

pkg/proxy/proxy.go

-// GetRequestAttributes populates authorizer attributes for the requests to kube-rbac-proxy.
-func (n krpAuthorizerAttributesGetter) GetRequestAttributes(u user.Info, r *http.Request) []authorizer.Attributes {
-	apiVerb := ""
-	switch r.Method {


Falling through with an empty verb isn't what I would expect. Why does it do this instead of Unknown_r.Method or failing?

TODO: pre-acceptance closing the empty verb hole

didn't find good precedence in k8s which quickly looking but we should investigate.

If the method is not specified, SAR returns allowed only if the identity is allowed to use all verbs with "*", but we could make it explicit by starting of with "*" instead of "".

deads2k · 2022-03-24T17:39:29Z

pkg/proxy/proxy.go

-		allAttrs := append(allAttrs, authorizer.AttributesRecord{
-			User:            u,
-			Verb:            apiVerb,
-			Namespace:       n.authzConfig.ResourceAttributes.Namespace,


Do these values match what was provided in the --config from back in main.go?

Yes. The configfile is unmarshaled into the Config type that has the Namespace ResourceAttributes.

But only in the particular case of n.authzConfig.Rewrites == nil, otherwise it might be a template.

deads2k · 2022-03-24T17:42:05Z

pkg/proxy/proxy.go

-		}
-	}
-
-	if len(params) == 0 {


This is a case where the configuration means: "forward this request without performing authorization"? I need to check the config file format, but I'm surprised that the default is "don't protect". Am I reading this incorrectly?

Well, the logic is not trivial and begs to break on code changes, but it looks like so:

We start with empty allAttr.

The next two if-blocks are returning.

The next two if-blocks fill the params.

If params is empty, return allAttrs, which is by then is still empty.

And here we fail, if the returned allAttrs is empty.

TODO: pre-acceptance this should proactively error from this method so that we aren't succeeding by coordination in two unrelated parts.

deads2k · 2022-03-24T17:44:56Z

pkg/proxy/proxy.go

-		attrs := authorizer.AttributesRecord{
-			User:            u,
-			Verb:            apiVerb,
-			Namespace:       templateWithValue(n.authzConfig.ResourceAttributes.Namespace, param),


So this means that the same param is passed to every possible resource attribute for golang template substitution? That means that the header and query param can only logically control a single aspect without differentiating between header and query param?

Making sure I understand and that it's well described. The behavior is acceptable.

Actually, this seems somewhat risky. If I specify multiple headers and get one to succeed, but the others fail, how can we be assured that the consuming application honors the same header or query param that passed?

This must be documented as an "if any of these values, controlled by the caller, pass validation, the request is allowed" case.

EDIT: re-reading from above, it actually means "everything must allow", but it forgot to get values for repeated headers?

So as far as I understand it,

We can specify values through query (multiple) and through the header (first).

Those values get individually applied to the config.

Where there are template markers, those get replaced.

We append it to the authorizer.AttributesRecord.

Simple, non-hacky example:
https://github.com/brancz/kube-rbac-proxy/blob/master/test/e2e/static-auth/configmap-resource.yaml#L9-L14=

TODO: pre-acceptance. headers are map[string][]string. This code needs to properly handle that.

pkg/proxy/proxy.go

deads2k · 2022-04-01T14:26:13Z

pkg/proxy/proxy.go

-}
-
-// DeepCopy of Proxy Configuration
-func (c *Config) DeepCopy() *Config {


TODO: pre-acceptance either remove or fuzz test. This is similar to the deep copy of rest.config in k8s.io/client-go to be sure that adding fields doesn't result in non-deepcopiable results or incorrect deep copies.

let's remove, it seems unused.

deads2k · 2022-04-01T14:29:06Z

transport.go

-	}
-
-	// http.Transport sourced from go 1.10.7
-	transport := &http.Transport{


TODO: pre-acceptance diff with k/k transport defaults

deads2k · 2022-04-01T14:31:32Z

main.go

-		proxy.Transport = &http2.Transport{
-			// Allow http schema. This doesn't automatically disable TLS
-			AllowHTTP: true,
-			// Do disable TLS.


TODO: pre-acceptance figure out why it's save to disable TLS. If it isn't safe to disable TLS (seems questionable for a proxy) stop doing it.

@deads2k what is kube's stance on supporting h2c? If kube does not explicitly support it, i think this is fine to be removed.

(again, a breaking change with announcement necessary if we decide that path)

@liggitt @enj transport configuration for proxy

By doing some reading on h2c, the code and history digging, I found that this is meant to be used for proxy to upstream communication and not anyone else.
It seems like some folks wanted to protect tiller (which did h2c) and what not.
In combination with your comment here @deads2k, which I agree on, I would revisit the configuration / logic for identity forwarding in such cases.

deads2k · 2022-04-01T14:34:49Z

main.go

-		for _, pathAllowed := range cfg.allowPaths {
-			found, err = path.Match(pathAllowed, req.URL.Path)
-			if err != nil {
-				return


If we have an error, why not at least return a 500 to the user?

TODO: pre-acceptance either return an error (doesn't have to be the real error) or write a test proving that this produces an error.

deads2k · 2022-04-01T14:37:16Z

main.go

-
-	mux := http.NewServeMux()
-	mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		found := len(cfg.allowPaths) == 0


personal taste: I found this logic difficult to read and would find it easier with a switch/case I think.

I agree. It might be prone to fatal mistakes.

deads2k · 2022-04-01T14:37:53Z

main.go

-	}
-
-	mux := http.NewServeMux()
-	mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {


I'm not seeing a unit test for this

TODO: pre-acceptance this mux handling method must have have 100% unit test coverage.

deads2k · 2022-04-01T14:38:45Z

main.go

-		for _, pathIgnored := range cfg.ignorePaths {
-			ignorePathFound, err = path.Match(pathIgnored, req.URL.Path)
-			if err != nil {
-				return


same error comment as above.

deads2k · 2022-04-01T14:40:29Z

pkg/proxy/proxy.go

-
-// Handle authenticates the client and authorizes the request.
-// If the authn fails, a 401 error is returned. If the authz fails, a 403 error is returned
-func (h *kubeRBACProxy) Handle(w http.ResponseWriter, req *http.Request) bool {


TODO: pre-acceptance, explain what the bool means. I think it means, "passed authentication and authorization", but it's relied on from main.go as simply, ok, so it's less than clear.

deads2k · 2022-04-01T14:41:41Z

main.go

-			}
-		}
-
-		proxy.ServeHTTP(w, req)


Flag for diff against the kube-apiserver upgradeaware proxy. I'm surprised a different proxy is being used here than the aggregated apiserver proxy. I remember issues with ugprade awareness.

deads2k · 2022-04-01T14:43:23Z

main.go

-		if cfg.secureListenAddress != "" {
-			srv := &http.Server{Handler: mux, TLSConfig: &tls.Config{}}
-
-			if cfg.tls.certFile == "" && cfg.tls.keyFile == "" {


For a proxy you'd expect something external to trust and hand a token to, generating a self-signed one here doesn't seem particularly helpful.

deads2k · 2022-04-01T14:49:24Z

main.go

-	var gr run.Group
-	{
-		if cfg.secureListenAddress != "" {
-			srv := &http.Server{Handler: mux, TLSConfig: &tls.Config{}}


most of this actually looks like it wants k8s.io/apiserver ServingOptions for the ports, bind addresses, certs, tls ciphers, etc.

the more i think about the more i believe we should strongly consider reusing k8s.io/apiserver serving logic (and options).

deads2k · 2022-04-01T14:50:45Z

main.go

-			srv.TLSConfig.MinVersion = version
-			srv.TLSConfig.ClientAuth = tls.RequestClientCert
-
-			if err := http2.ConfigureServer(srv, nil); err != nil {


TODO, if this isn't replaced with upstream's serving library, the tls and listener logic here needs review.

deads2k · 2022-04-27T18:53:45Z

main.go

-		}
-	}
-
-	proxy := httputil.NewSingleHostReverseProxy(upstreamURL)


@enj @liggitt does it proxy how we'd expect?

ibihim · 2023-04-05T13:49:50Z

The purpose of this PR was to create the issues. I would close the PR as of now. The issues are still open and reference key discussion of this PR.

comment on code

90ba0d1

Signed-off-by: Krzysztof Ostrowski <[email protected]>

ibihim changed the title ~~Comment on code~~ [wip][don't merge][ever][pretty please] Comment on code Feb 17, 2022

deads2k reviewed Feb 17, 2022

View reviewed changes

ibihim mentioned this pull request Feb 23, 2022

Request for moving this project repo under kubernetes-sigs #23

Closed

deads2k reviewed Mar 24, 2022

View reviewed changes

pkg/proxy/proxy.go Show resolved Hide resolved

deads2k reviewed Apr 1, 2022

View reviewed changes

This was referenced Apr 25, 2022

Sig-Auth Post-Acceptance TODOs #168

Open

Sig-Auth Pre-Acceptance TODOs #169

Closed

deads2k reviewed Apr 27, 2022

View reviewed changes

main.go

}

}

proxy := httputil.NewSingleHostReverseProxy(upstreamURL)

Copy link

deads2k Apr 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@enj @liggitt does it proxy how we'd expect?

ibihim changed the title ~~[wip][don't merge][ever][pretty please] Comment on code~~ sig-auth review: comment on code Apr 29, 2022

This was referenced Aug 17, 2022

pkg/proxy: rm unused args #189

Merged

pkg/authz: rename Equal to Matches #191

Merged

Cache ttl comment #192

Merged

[wip] Handler rework #193

Closed

ibihim closed this Apr 5, 2023

sig-auth review: comment on code #162

sig-auth review: comment on code #162

Conversation

ibihim commented Feb 17, 2022

deads2k Feb 17, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k Feb 17, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k Feb 17, 2022 • edited Loading

Choose a reason for hiding this comment

ibihim Mar 30, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k Feb 17, 2022 • edited Loading

Choose a reason for hiding this comment

ibihim Mar 30, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k Feb 17, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ibihim Aug 17, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k Mar 24, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k Mar 24, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ibihim Mar 30, 2022 • edited Loading

Choose a reason for hiding this comment

ibihim Mar 30, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ibihim Mar 30, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k Mar 24, 2022 • edited Loading

Choose a reason for hiding this comment

ibihim Mar 30, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k Feb 17, 2022 •

edited

Loading

deads2k Feb 17, 2022 •

edited

Loading

deads2k Feb 17, 2022 •

edited

Loading

ibihim Mar 30, 2022 •

edited

Loading

deads2k Feb 17, 2022 •

edited

Loading

ibihim Mar 30, 2022 •

edited

Loading

deads2k Feb 17, 2022 •

edited

Loading

ibihim Aug 17, 2022 •

edited

Loading

deads2k Mar 24, 2022 •

edited

Loading

deads2k Mar 24, 2022 •

edited

Loading

ibihim Mar 30, 2022 •

edited

Loading

ibihim Mar 30, 2022 •

edited

Loading

ibihim Mar 30, 2022 •

edited

Loading

deads2k Mar 24, 2022 •

edited

Loading

ibihim Mar 30, 2022 •

edited

Loading

deads2k Apr 1, 2022 •

edited

Loading