Parse and verify certificates with options #6583

yogisinha · 2024-02-11T19:55:20Z

Why the changes in this PR are needed?

parse and verify x509 certificates with additional options was requested

What are the changes in this PR?

buitins.go and crypto.go were modified

Notes to assist PR review:

This is a draft PR as requested by @ashutosh-narkar.
Please comment if the implementation looks right

Further comments:

Just to pass the existing tests I created a another method verifyX509CertificateChainWithOpts which is same as verifyX509CertificateChain except it takes additional verifyOptions struct. I can remove this method and add this extra verifyOptions to verifyX509CertificateChain and change the test cases later. verifyX509CertificateChainWithOpts is just temporary.

For an e.g. This method will be called as :

crypto.x509.parse_and_verify_certificates_with_options(
pem encoded cert data,
'{
"DNSName": "some_value", "CurrentTime": "value in millis epoch", 
"KeyUsages": ["KeyUsageServerAuth", "KeyUsageClientAuth", "KeyUsageCodeSigning"]}",
"MaxConstraintComparisons": "int value"
)'
)

Squashing all the commits for following issue: Fix for the issue when OPA doesnot load tarball on cmd line as a bundle. Fixes open-policy-agent#5879 Signed-off-by: Yogesh Sinha <[email protected]>

…options. Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

netlify · 2024-02-11T19:56:40Z

✅ Deploy Preview for openpolicyagent ready!

Name	Link
🔨 Latest commit	`91e9007`
🔍 Latest deploy log	https://app.netlify.com/sites/openpolicyagent/deploys/65fbfc10ae698f0008217e9a
😎 Deploy Preview	https://deploy-preview-6583--openpolicyagent.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

ashutosh-narkar · 2024-02-14T17:21:32Z

@yogisinha thanks for the contribution. Can you please resolve the conflicts in the PR?

yogisinha · 2024-02-14T23:43:04Z

I resolved the conflicts.

charlieegan3

Hi @yogisinha, thanks for this PR. It's a great start and having these options available will be handy.

In addition to my comments below, I think it'd be good to have some test cases for the new function. You can see some examples here to get you started https://github.com/open-policy-agent/opa/blob/cfb03ca495111cbcce98acce93bf96b8433f4f35/topdown/crypto_test.go#L144-L143

Thanks again and sorry to take a while to get back to you. that's on me.

charlieegan3 · 2024-02-19T18:06:43Z

ast/builtins.go

+	Name: "crypto.x509.parse_and_verify_certificates_with_options",
+	Description: `Returns one or more certificates from the given string containing PEM
+or base64 encoded DER certificates after verifying the supplied certificates form a complete
+certificate chain back to a trusted root. Second argument is a option object to validate the 


This line looks to be incomplete? the note about the options seems to be cut off.

Hi @charlieegan3 ,
Is there any way to see the documentation of functions on browser, serving the content from my local opa. I want to see how it looks on browser under "Built in functions" page for my new function description.

Hey, the best way to check is:

make generate # update the top level generated builtin_metadata.json file cd docs/ make dev-generate cd website hugo server --contentDir=generated/

Then visit: http://localhost:1313/docs/edge/policy-reference/#built-in-functions

Hope that helps!

Hi,
its giving me following error on last step. I didn't have hugo so I installed it by sudo apt install hugo. I will commit the newly generated json files though.

~/opa/docs/website$ hugo server --contentDir=generated/

Building sites … ERROR 2024/02/21 11:55:13 render of "page" failed: "/home/yogi/opa/docs/website/layouts/docs/ecosystem-single.html.html:20:17": execute of template failed: template: docs/ecosystem-single.html.html:20:17: executing "content" at <path>: can't evaluate field BaseName in type interface {} ERROR 2024/02/21 11:55:13 render of "page" failed: "/home/yogi/opa/docs/website/layouts/docs/ecosystem-single.html.html:20:17": execute of template failed: template: docs/ecosystem-single.html.html:20:17: executing "content" at <path>: can't evaluate field BaseName in type interface {} ERROR 2024/02/21 11:55:13 render of "page" failed: "/home/yogi/opa/docs/website/layouts/docs/ecosystem-single.html.html:20:17": execute of template failed: template: docs/ecosystem-single.html.html:20:17: executing "content" at <path>: can't evaluate field BaseName in type interface {} ERROR 2024/02/21 11:55:13 render of "page" failed: "/home/yogi/opa/docs/website/layouts/docs/ecosystem-single.html.html:20:17": execute of template failed: template: docs/ecosystem-single.html.html:20:17: executing "content" at <path>: can't evaluate field BaseName in type interface {} Built in 1659 ms Error: Error building site: failed to render pages: render of "page" failed: "/home/yogi/opa/docs/website/layouts/docs/ecosystem-single.html.html:20:17": execute of template failed: template: docs/ecosystem-single.html.html:20:17: executing "content" at <path>: can't evaluate field BaseName in type interface {}

Hmm, I am not sure what would be causing that... 🤔

how about here: https://deploy-preview-6583--openpolicyagent.netlify.app/docs/edge/policy-reference/#builtin-crypto-cryptox509parse_and_verify_certificates_with_options

charlieegan3 · 2024-02-19T18:07:24Z

ast/builtins.go

+						types.NewSet(types.A),
+					),
+				)),
+			).Description("object containing a set or array of neighboring vertices"),


neighboring vertices

What is this meant to refer to. I thought the options were meant to be the key usages?

charlieegan3 · 2024-02-19T18:10:34Z

topdown/crypto.go

 	return iter(valid)
 }

+type verifyOptions struct {


question: is there a reason we can't use the golang type? https://pkg.go.dev/crypto/x509#VerifyOptions

charlieegan3 · 2024-02-19T18:20:47Z

topdown/crypto.go

+	return iter(valid)
+}
+
+func extractVerifyOpts(options ast.Object) (verifyOpt verifyOptions, err error) {


I think that it would be nice to have some tests for this function that map the Rego options to the golang struct (https://pkg.go.dev/crypto/x509#VerifyOptions)

charlieegan3 · 2024-02-19T18:22:30Z

topdown/crypto.go

 	return chains[0], nil
 }

+func verifyX509CertificateChainWithOpts(certs []*x509.Certificate, vo verifyOptions) ([]*x509.Certificate, error) {


I think that rather than making a new function here we can extend verifyX509CertificateChain to support the passing of an existing options struct that is extended if present or initialised fresh if not.

Yes, I plan to do that. because extending verifyX509CertificateChain was making some of the existing test cases fail so thats why I created the new function just to pass the tests as this was Draft PR. I will make the change and rest of your suggestions too. Thanks.

👍 sounds like a good plan, thanks.

charlieegan3 · 2024-02-19T18:28:41Z

topdown/crypto.go

+					return verifyOpt, fmt.Errorf("CurrentTime could not be parsed to be a valid int64 number.")
+				}
+			} else {
+				return verifyOpt, fmt.Errorf("CurrentTime should be a number")


Also, there are some linter errors for these messages since they start with uppercase letters. I think they could be adjusted to "field 'CurrentTime' should be a number" or similar to get around the issue.

…ion. Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Signed-off-by: Yogesh Sinha <[email protected]>

yogisinha · 2024-02-21T14:38:55Z

@charlieegan3 ,
I made all the changes. Please take a look.

charlieegan3 · 2024-02-21T16:27:10Z

Hey, I have added a comment here #6583 (comment) regarding previewing the docs. I think you're also going to need to run make generate and commit the new builtins JSON too. Thanks!

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

…github.com/yogisinha/opa into parse_and_verify_certificates_with_options doing git pull

yogisinha · 2024-02-21T17:16:33Z

Hey, I have added a comment here #6583 (comment) regarding previewing the docs. I think you're also going to need to run make generate and commit the new builtins JSON too. Thanks!

Added the json files.

charlieegan3

Thanks for adding the test and the other edits based on my comments above. It's taking shape, just a few more minor ones.

charlieegan3 · 2024-02-21T18:10:17Z

ast/builtins.go

+	Description: `Returns one or more certificates from the given string containing PEM
+or base64 encoded DER certificates after verifying the supplied certificates form a complete
+certificate chain back to a trusted root. Second argument is a option object to pass
+extra configs to verify the validity of certificates.


"Second argument is a option object to pass extra configs to verify the validity of certificates."

I would change this to:

"A config option passed as the second argument can be used to configure the validation options used."

charlieegan3 · 2024-02-21T18:12:07Z

ast/builtins.go

+extra configs to verify the validity of certificates.
+
+The first certificate is treated as the root and the last is treated as the leaf,
+with all others being treated as intermediates.` +


Suggested change

with all others being treated as intermediates.` +

with all others being treated as intermediates.

` +

charlieegan3 · 2024-02-21T18:14:20Z

ast/builtins.go

+		"`\"MaxConstraintComparisons\" : 5,`" +
+		"`}`" +
+		"Then this function call will look like: `crypto.x509.parse_and_verify_certificates_with_options(<cert base64 encoded string>, options)`" +
+		"This option's field has same definitions as fields in [x509.VerifyOptions struct](https://pkg.go.dev/crypto/x509#VerifyOptions)" +


Screen.Recording.2024-02-21.at.18.13.21.mov

I think that we need to make some of these lines less long, as it's pushing out the rest of the table at the moment. Some strategic line breaks should be 👌

Yes, I realized that too and was already working on that

charlieegan3 · 2024-02-21T18:16:35Z

ast/builtins.go

+		"`\"MaxConstraintComparisons\" : 5,`" +
+		"`}`" +
+		"Then this function call will look like: `crypto.x509.parse_and_verify_certificates_with_options(<cert base64 encoded string>, options)`" +
+		"This option's field has same definitions as fields in [x509.VerifyOptions struct](https://pkg.go.dev/crypto/x509#VerifyOptions)" +


Suggested change

"This option's field has same definitions as fields in [x509.VerifyOptions struct](https://pkg.go.dev/crypto/x509#VerifyOptions)" +

"This options object has the same fields as [x509.VerifyOptions](https://pkg.go.dev/crypto/x509#VerifyOptions)" +

ast/builtins.go

charlieegan3 · 2024-02-21T18:28:39Z

ast/builtins.go

+		"`}`" +
+		"Then this function call will look like: `crypto.x509.parse_and_verify_certificates_with_options(<cert base64 encoded string>, options)`" +
+		"This option's field has same definitions as fields in [x509.VerifyOptions struct](https://pkg.go.dev/crypto/x509#VerifyOptions)" +
+		"`CurrentTime` is nanoseconds since epoch" +


Suggested change

"`CurrentTime` is nanoseconds since epoch" +

"`CurrentTime` is the number of nanoseconds since the Unix Epoch as a number" +

charlieegan3 · 2024-02-21T18:31:13Z

topdown/crypto.go

+
+	for _, key := range options.Keys() {
+		switch key.String() {
+		case "\"DNSName\"":


It might be nicer to clean the quote from the key at the top of the loop iteration, this might make it look a little more tidy in the cases.

topdown/crypto.go

charlieegan3 · 2024-02-21T18:34:43Z

topdown/crypto.go

+				})
+
+			} else {
+				return verifyOpt, fmt.Errorf("'KeyUsages' should be a set")


Might we want to support the case where the user supplies an array?

I decided on Set because it automatically dedups the Key usage entry if user has supplied same entry more than once. Array would not do that. LMK what you think?

I was just imagining that a user might provide an array by mistake, if it were coming from input or data loaded from JSON this is quite likely. I agree that a Set is what we'd like to receive in an ideal case, but I think there's merit in covering an array as input too.

makes sense. I would change that.

I think having dup in array is ok. its not a issue. I looked into Go code and passing list with dup key usages should be fine. just extra loop executions in this part of code: https://cs.opensource.google/go/go/+/refs/tags/go1.22.0:src/crypto/x509/verify.go;l=1166

I added the Array type for KeyUsages.

charlieegan3 · 2024-02-21T18:35:39Z

topdown/crypto_test.go

+	}{
+		{
+			jsonOption: ast.MustParseTerm(`{"DNSName": 1}`),
+			expectErr:  true,


It would be nice to know what the error was in such cases, perhaps checking a string or something in the err.Error()

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

charlieegan3 · 2024-02-27T22:01:10Z

Hey @yogisinha, are you able to take a look at the conflicts with main again?

yogisinha · 2024-02-27T22:22:13Z

Are you talking about this message "This branch is out-of-date with the base branch" . This was not coming before. What should I do ? Should I do "Update with merge commit" ?

charlieegan3 · 2024-02-27T22:24:26Z

Hey, yeah best would be to run:

git fetch origin
git rebase origin/main
# address any conflicts and make sure the tests all pass etc
git rebase --continue
git push -f

…options. Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

…ion. Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

ast/builtins.go

ashutosh-narkar

@yogisinha thanks for working on this. It would be helpful to add a unit test that actually tests the new builtin itself in addition to what you already have. Thanks.

…parse_and_verify_certificates_with_options merge

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

yogisinha · 2024-03-10T03:04:56Z

Added the test case.

ashutosh-narkar

Thanks for adding the test cases and addressing other comments. Please squash your commits and we can get this in.

topdown/crypto.go

charlieegan3

Hi @yogisinha, thanks for all the work on this. I think the code is looking great now.

My only final comment is that the docs are still pushing out the table. This built-in table is a bit of a pain to work with... but I'd like to keep it without a h-scroll bar if possible. Perhaps the options can be a bulleted list?

Screen.Recording.2024-03-12.at.09.15.54.mov

The video compares main and this branch in different tabs

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

…parse_and_verify_certificates_with_options Merge

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

yogisinha · 2024-03-13T22:47:57Z

@charlieegan3 ,
I think it looks good now. I had to make several commits incrementally to see the behavior of deploy preview.

charlieegan3 · 2024-03-18T10:05:38Z

topdown/crypto.go

+		if err != nil {
+			return verifyOpt, err
+		}
+		k = k.(string)


Since ast.JSON returns an interface{}, I think we need to make this a check too.

E.g. key, ok := k.(string)

and then if !ok { ... // return err etc }

But giving keys that are not string type will be caught by rego type checker. I tried that and it threw the error and won't even call the function. Shall I still add it ?

Ahh I see, hmm... perhaps we can just continue in the loop if the key is not a string?

Added that.

charlieegan3

This looks good to me now, I can still see that the table is overflowing but there are other overflowing tables on the page (net functions) so I think we need to do some more work on the site's styles there.

I have one final comment, then we can rebase and get this in.

…parse_and_verify_certificates_with_options merge

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

This adds the new builtin to the capabilities.json and builtin_metadata.json Signed-off-by: Charlie Egan <[email protected]>

charlieegan3 · 2024-03-21T09:25:01Z

Hey, I think we are nearly there now @yogisinha, I have updated the generated code in 91e9007 but can you rebase this from origin/main so that we can get this in. I'm at KubeCon at the moment so have limited time to help, but will reply when I get a chance.

Thanks for your work here, much appreciated!

yogisinha · 2024-03-23T13:44:47Z

Hi @charlieegan3 ,
I created a new PR . I was getting lot of conflicts when I was trying to rebase, don't know why. In that new PR, everything is in single commit.

New PR: #6643

ashutosh-narkar · 2024-03-25T18:37:38Z

Closing this in favor of #6643.

yogisinha added 2 commits August 30, 2023 07:41

Changed the LoadPaths function.

e362e13

Squashing all the commits for following issue: Fix for the issue when OPA doesnot load tarball on cmd line as a bundle. Fixes open-policy-agent#5879 Signed-off-by: Yogesh Sinha <[email protected]>

Adding a new function crypto.x509.parse_and_verify_certificates_with_…

23ceed5

…options. Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

yogisinha mentioned this pull request Feb 11, 2024

Add a crypto.x509.parse_and_verify_certificates_with_keys builtin #5882

Closed

ashutosh-narkar requested a review from charlieegan3 February 14, 2024 23:48

charlieegan3 reviewed Feb 19, 2024

View reviewed changes

Added test case, using Go x509.VerifyOptions, fixed function descript…

35d2f85

…ion. Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

yogisinha force-pushed the parse_and_verify_certificates_with_options branch from bf33692 to 35d2f85 Compare February 21, 2024 14:10

Merge branch 'main' into parse_and_verify_certificates_with_options

a1f123d

Signed-off-by: Yogesh Sinha <[email protected]>

yogisinha added 2 commits February 21, 2024 12:08

Added auto generated builtins json files.

4a472ff

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Merge branch 'parse_and_verify_certificates_with_options' of https://…

290918c

…github.com/yogisinha/opa into parse_and_verify_certificates_with_options doing git pull

charlieegan3 reviewed Feb 21, 2024

View reviewed changes

yogisinha added 5 commits February 21, 2024 16:17

Added changes as per suggestions.

c91d9cd

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Added new lines

6ba2619

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Added new lines

a8ba1d1

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Added new lines

9c655c3

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Added the new Array type for KeyUsages

6b32620

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

yogisinha closed this Feb 27, 2024

yogisinha reopened this Feb 27, 2024

yogisinha added 2 commits February 27, 2024 19:37

Adding a new function crypto.x509.parse_and_verify_certificates_with_…

4f240dd

…options. Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Added test case, using Go x509.VerifyOptions, fixed function descript…

4597ffe

…ion. Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

ashutosh-narkar reviewed Mar 6, 2024

View reviewed changes

ast/builtins.go Show resolved Hide resolved

ashutosh-narkar reviewed Mar 6, 2024

View reviewed changes

yogisinha added 2 commits March 9, 2024 22:01

Merge branch 'main' of https://github.com/open-policy-agent/opa into …

dc6683a

…parse_and_verify_certificates_with_options merge

Added the test case for parse cert with options.

a9b4bd8

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

ashutosh-narkar reviewed Mar 11, 2024

View reviewed changes

ashutosh-narkar requested a review from charlieegan3 March 11, 2024 23:44

charlieegan3 reviewed Mar 12, 2024

View reviewed changes

topdown/crypto.go Show resolved Hide resolved

charlieegan3 reviewed Mar 12, 2024

View reviewed changes

yogisinha added 10 commits March 12, 2024 15:33

Changes as per suggestions.

720b333

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Shortening the function name.

f992c0d

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Commenting out the function to check the deploy preview without this.

9effeab

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Merge branch 'main' of https://github.com/open-policy-agent/opa into …

ea77470

…parse_and_verify_certificates_with_options Merge

Some changes.

3c31aa6

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Some changes.

580fa87

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

changes to test preview.

f9b196d

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

changes to test preview.

5cad579

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

changes to test preview.

49796ad

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

changes to test preview.

8ebe57a

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

ashutosh-narkar requested a review from charlieegan3 March 15, 2024 15:02

charlieegan3 reviewed Mar 18, 2024

View reviewed changes

yogisinha and others added 3 commits March 18, 2024 11:48

Merge branch 'main' of https://github.com/open-policy-agent/opa into …

ce4a226

…parse_and_verify_certificates_with_options merge

Suggested changes.

3993618

Fixes open-policy-agent#5882 Signed-off-by: Yogesh Sinha <[email protected]>

Update generated code

91e9007

This adds the new builtin to the capabilities.json and builtin_metadata.json Signed-off-by: Charlie Egan <[email protected]>

ashutosh-narkar closed this Mar 25, 2024

	"This option's field has same definitions as fields in [x509.VerifyOptions struct](https://pkg.go.dev/crypto/x509#VerifyOptions)" +
	"This options object has the same fields as [x509.VerifyOptions](https://pkg.go.dev/crypto/x509#VerifyOptions)" +

	"`CurrentTime` is nanoseconds since epoch" +
	"`CurrentTime` is the number of nanoseconds since the Unix Epoch as a number" +

Parse and verify certificates with options #6583

Parse and verify certificates with options #6583

Uh oh!

Conversation

yogisinha commented Feb 11, 2024

Why the changes in this PR are needed?

What are the changes in this PR?

Notes to assist PR review:

Further comments:

Uh oh!

netlify bot commented Feb 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for openpolicyagent ready!

Uh oh!

ashutosh-narkar commented Feb 14, 2024

Uh oh!

yogisinha commented Feb 14, 2024

Uh oh!

charlieegan3 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogisinha Feb 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogisinha commented Feb 21, 2024

Uh oh!

charlieegan3 commented Feb 21, 2024

Uh oh!

yogisinha commented Feb 21, 2024

Uh oh!

charlieegan3 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

netlify bot commented Feb 11, 2024 •

edited

Loading

yogisinha Feb 21, 2024 •

edited

Loading

yogisinha Feb 22, 2024 •

edited

Loading

charlieegan3 left a comment •

edited

Loading