Response blocking in openliberty by cataphract · Pull Request #5657 · DataDog/dd-trace-java

cataphract · 2023-07-28T15:34:53Z

No description provided.

pr-commenter · 2023-07-28T15:52:45Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
commit	1.20.0-SNAPSHOT~e3aa415c99	1.20.0-SNAPSHOT~bcd9abb27f
config	baseline	candidate

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
module	Agent	Agent
parent	None	None
variant	appsec	appsec

Summary

Found 9 performance improvements and 1 performance regressions! Performance is the same for 52 cases.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:insecure-bank:appsec:Telemetry	better [-652.015µs; -454.549µs] or [-11.297%; -7.876%]	5.218ms	5.772ms
scenario:insecure-bank:iast:Remote Config	worse [+12.476µs; +85.918µs] or [+2.220%; +15.288%]	611.208µs	562.010µs
scenario:insecure-bank:iast:Telemetry	better [-832.985µs; -405.507µs] or [-14.377%; -6.999%]	5.175ms	5.794ms
scenario:insecure-bank:profiling:Remote Config	better [-43.583µs; -16.131µs] or [-6.563%; -2.429%]	634.169µs	664.026µs
scenario:insecure-bank:profiling:Telemetry	better [-763.414µs; -548.512µs] or [-12.751%; -9.162%]	5.331ms	5.987ms
scenario:insecure-bank:tracing:Telemetry	better [-759.021µs; -584.203µs] or [-12.590%; -9.690%]	5.357ms	6.029ms
scenario:petclinic:appsec:Telemetry	better [-683.278µs; -453.435µs] or [-11.815%; -7.841%]	5.215ms	5.783ms
scenario:petclinic:iast:Telemetry	better [-840.701µs; -650.111µs] or [-14.094%; -10.899%]	5.220ms	5.965ms
scenario:petclinic:profiling:Telemetry	better [-738.131µs; -489.436µs] or [-12.341%; -8.183%]	5.367ms	5.981ms
scenario:petclinic:tracing:Telemetry	better [-730.817µs; -546.564µs] or [-12.077%; -9.032%]	5.413ms	6.051ms

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~bcd9abb27f, baseline=1.20.0-SNAPSHOT~e3aa415c99

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (992.491 ms) : 0, 992491
Total [baseline] (8.68 s) : 0, 8680180
Agent [candidate] (988.257 ms) : 0, 988257
Total [candidate] (8.64 s) : 0, 8640314
section appsec
Agent [baseline] (1.072 s) : 0, 1072191
Total [baseline] (8.732 s) : 0, 8732132
Agent [candidate] (1.075 s) : 0, 1075080
Total [candidate] (8.752 s) : 0, 8752406
section iast
Agent [baseline] (1.097 s) : 0, 1096876
Total [baseline] (9.22 s) : 0, 9220232
Agent [candidate] (1.096 s) : 0, 1096384
Total [candidate] (9.26 s) : 0, 9259899
section profiling
Agent [baseline] (1.167 s) : 0, 1166894
Total [baseline] (8.928 s) : 0, 8928270
Agent [candidate] (1.156 s) : 0, 1155654
Total [candidate] (8.882 s) : 0, 8881869

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	992.491 ms	-
Agent	appsec	1.072 s	79.7 ms (8.0%)
Agent	iast	1.097 s	104.385 ms (10.5%)
Agent	profiling	1.167 s	174.403 ms (17.6%)
Total	tracing	8.68 s	-
Total	appsec	8.732 s	51.952 ms (0.6%)
Total	iast	9.22 s	540.052 ms (6.2%)
Total	profiling	8.928 s	248.091 ms (2.9%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	988.257 ms	-
Agent	appsec	1.075 s	86.823 ms (8.8%)
Agent	iast	1.096 s	108.127 ms (10.9%)
Agent	profiling	1.156 s	167.397 ms (16.9%)
Total	tracing	8.64 s	-
Total	appsec	8.752 s	112.092 ms (1.3%)
Total	iast	9.26 s	619.585 ms (7.2%)
Total	profiling	8.882 s	241.555 ms (2.8%)

gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~bcd9abb27f, baseline=1.20.0-SNAPSHOT~e3aa415c99

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (615.152 ms) : 0, 615152
BytebuddyAgent [candidate] (611.781 ms) : 0, 611781
GlobalTracer [baseline] (285.886 ms) : 0, 285886
GlobalTracer [candidate] (285.827 ms) : 0, 285827
AppSec [baseline] (50.153 ms) : 0, 50153
AppSec [candidate] (50.272 ms) : 0, 50272
Remote Config [baseline] (665.486 µs) : 0, 665
Remote Config [candidate] (671.935 µs) : 0, 672
Telemetry [baseline] (6.029 ms) : 0, 6029
Telemetry [candidate] (5.357 ms) : 0, 5357
section appsec
BytebuddyAgent [baseline] (611.526 ms) : 0, 611526
BytebuddyAgent [candidate] (613.163 ms) : 0, 613163
GlobalTracer [baseline] (283.867 ms) : 0, 283867
GlobalTracer [candidate] (286.136 ms) : 0, 286136
AppSec [baseline] (135.803 ms) : 0, 135803
AppSec [candidate] (135.347 ms) : 0, 135347
Remote Config [baseline] (728.98 µs) : 0, 729
Remote Config [candidate] (721.727 µs) : 0, 722
Telemetry [baseline] (5.772 ms) : 0, 5772
Telemetry [candidate] (5.218 ms) : 0, 5218
section iast
BytebuddyAgent [baseline] (722.429 ms) : 0, 722429
BytebuddyAgent [candidate] (721.297 ms) : 0, 721297
GlobalTracer [baseline] (272.222 ms) : 0, 272222
GlobalTracer [candidate] (273.455 ms) : 0, 273455
AppSec [baseline] (47.277 ms) : 0, 47277
AppSec [candidate] (46.834 ms) : 0, 46834
Remote Config [baseline] (562.01 µs) : 0, 562
Remote Config [candidate] (611.208 µs) : 0, 611
Telemetry [baseline] (5.794 ms) : 0, 5794
Telemetry [candidate] (5.175 ms) : 0, 5175
IAST [baseline] (13.968 ms) : 0, 13968
IAST [candidate] (14.35 ms) : 0, 14350
section profiling
BytebuddyAgent [baseline] (628.723 ms) : 0, 628723
BytebuddyAgent [candidate] (623.826 ms) : 0, 623826
GlobalTracer [baseline] (351.285 ms) : 0, 351285
GlobalTracer [candidate] (349.213 ms) : 0, 349213
AppSec [baseline] (49.616 ms) : 0, 49616
AppSec [candidate] (48.984 ms) : 0, 48984
Remote Config [baseline] (664.026 µs) : 0, 664
Remote Config [candidate] (634.169 µs) : 0, 634
Telemetry [baseline] (5.987 ms) : 0, 5987
Telemetry [candidate] (5.331 ms) : 0, 5331
ProfilingAgent [baseline] (77.148 ms) : 0, 77148
ProfilingAgent [candidate] (74.881 ms) : 0, 74881
Profiling [baseline] (77.172 ms) : 0, 77172
Profiling [candidate] (74.905 ms) : 0, 74905

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~bcd9abb27f, baseline=1.20.0-SNAPSHOT~e3aa415c99

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (988.078 ms) : 0, 988078
Total [baseline] (9.258 s) : 0, 9258459
Agent [candidate] (989.48 ms) : 0, 989480
Total [candidate] (9.17 s) : 0, 9169876
section appsec
Agent [baseline] (1.081 s) : 0, 1080967
Total [baseline] (9.289 s) : 0, 9289427
Agent [candidate] (1.072 s) : 0, 1072456
Total [candidate] (9.281 s) : 0, 9281296
section iast
Agent [baseline] (1.101 s) : 0, 1100739
Total [baseline] (9.516 s) : 0, 9515939
Agent [candidate] (1.089 s) : 0, 1088886
Total [candidate] (9.442 s) : 0, 9442365
section profiling
Agent [baseline] (1.165 s) : 0, 1164667
Total [baseline] (9.482 s) : 0, 9482174
Agent [candidate] (1.16 s) : 0, 1159839
Total [candidate] (9.48 s) : 0, 9480351

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	988.078 ms	-
Agent	appsec	1.081 s	92.889 ms (9.4%)
Agent	iast	1.101 s	112.661 ms (11.4%)
Agent	profiling	1.165 s	176.589 ms (17.9%)
Total	tracing	9.258 s	-
Total	appsec	9.289 s	30.969 ms (0.3%)
Total	iast	9.516 s	257.481 ms (2.8%)
Total	profiling	9.482 s	223.715 ms (2.4%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	989.48 ms	-
Agent	appsec	1.072 s	82.976 ms (8.4%)
Agent	iast	1.089 s	99.406 ms (10.0%)
Agent	profiling	1.16 s	170.359 ms (17.2%)
Total	tracing	9.17 s	-
Total	appsec	9.281 s	111.42 ms (1.2%)
Total	iast	9.442 s	272.49 ms (3.0%)
Total	profiling	9.48 s	310.475 ms (3.4%)

gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~bcd9abb27f, baseline=1.20.0-SNAPSHOT~e3aa415c99

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (612.591 ms) : 0, 612591
BytebuddyAgent [candidate] (613.257 ms) : 0, 613257
GlobalTracer [baseline] (284.213 ms) : 0, 284213
GlobalTracer [candidate] (285.897 ms) : 0, 285897
AppSec [baseline] (50.207 ms) : 0, 50207
AppSec [candidate] (49.914 ms) : 0, 49914
Remote Config [baseline] (665.036 µs) : 0, 665
Remote Config [candidate] (662.244 µs) : 0, 662
Telemetry [baseline] (6.051 ms) : 0, 6051
Telemetry [candidate] (5.413 ms) : 0, 5413
section appsec
BytebuddyAgent [baseline] (616.331 ms) : 0, 616331
BytebuddyAgent [candidate] (612.156 ms) : 0, 612156
GlobalTracer [baseline] (286.956 ms) : 0, 286956
GlobalTracer [candidate] (285.235 ms) : 0, 285235
AppSec [baseline] (136.493 ms) : 0, 136493
AppSec [candidate] (134.933 ms) : 0, 134933
Remote Config [baseline] (734.954 µs) : 0, 735
Remote Config [candidate] (726.814 µs) : 0, 727
Telemetry [baseline] (5.783 ms) : 0, 5783
Telemetry [candidate] (5.215 ms) : 0, 5215
section iast
BytebuddyAgent [baseline] (723.895 ms) : 0, 723895
BytebuddyAgent [candidate] (715.354 ms) : 0, 715354
GlobalTracer [baseline] (273.96 ms) : 0, 273960
GlobalTracer [candidate] (272.051 ms) : 0, 272051
AppSec [baseline] (47.593 ms) : 0, 47593
AppSec [candidate] (46.956 ms) : 0, 46956
Remote Config [baseline] (589.421 µs) : 0, 589
Remote Config [candidate] (622.833 µs) : 0, 623
Telemetry [baseline] (5.965 ms) : 0, 5965
Telemetry [candidate] (5.22 ms) : 0, 5220
IAST [baseline] (14.19 ms) : 0, 14190
IAST [candidate] (14.323 ms) : 0, 14323
section profiling
BytebuddyAgent [baseline] (628.274 ms) : 0, 628274
BytebuddyAgent [candidate] (625.539 ms) : 0, 625539
GlobalTracer [baseline] (351.472 ms) : 0, 351472
GlobalTracer [candidate] (350.458 ms) : 0, 350458
AppSec [baseline] (49.361 ms) : 0, 49361
AppSec [candidate] (49.025 ms) : 0, 49025
Remote Config [baseline] (665.257 µs) : 0, 665
Remote Config [candidate] (640.727 µs) : 0, 641
Telemetry [baseline] (5.981 ms) : 0, 5981
Telemetry [candidate] (5.367 ms) : 0, 5367
ProfilingAgent [baseline] (75.573 ms) : 0, 75573
ProfilingAgent [candidate] (75.906 ms) : 0, 75906
Profiling [baseline] (75.597 ms) : 0, 75597
Profiling [candidate] (75.931 ms) : 0, 75931

Load

Parameters

	Baseline	Candidate
commit	1.20.0-SNAPSHOT~e3aa415c99	1.20.0-SNAPSHOT~bcd9abb27f
config	baseline	candidate
end_time	2023-08-18T12:14:22	2023-08-18T12:32:31
start_time	2023-08-18T12:14:04	2023-08-18T12:32:14

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~bcd9abb27f, baseline=1.20.0-SNAPSHOT~e3aa415c99
    dateFormat X
    axisFormat %s
section baseline
no_agent (368.768 µs) : 347, 390
.   : milestone, 369,
appsec (663.53 µs) : 643, 684
.   : milestone, 664,
iast (460.048 µs) : 440, 481
.   : milestone, 460,
iast_FULL (530.09 µs) : 510, 551
.   : milestone, 530,
iast_INACTIVE (446.951 µs) : 425, 469
.   : milestone, 447,
profiling (451.446 µs) : 430, 473
.   : milestone, 451,
tracing (442.452 µs) : 422, 463
.   : milestone, 442,
section candidate
no_agent (370.855 µs) : 349, 393
.   : milestone, 371,
appsec (663.276 µs) : 643, 684
.   : milestone, 663,
iast (458.118 µs) : 437, 479
.   : milestone, 458,
iast_FULL (531.823 µs) : 511, 553
.   : milestone, 532,
iast_INACTIVE (446.173 µs) : 425, 468
.   : milestone, 446,
profiling (438.473 µs) : 418, 459
.   : milestone, 438,
tracing (446.754 µs) : 425, 468
.   : milestone, 447,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	368.768 µs [347.496 µs, 390.039 µs]	-
appsec	663.53 µs [643.181 µs, 683.879 µs]	294.763 µs (79.9%)
iast	460.048 µs [439.52 µs, 480.576 µs]	91.281 µs (24.8%)
iast_FULL	530.09 µs [509.646 µs, 550.534 µs]	161.323 µs (43.7%)
iast_INACTIVE	446.951 µs [425.182 µs, 468.72 µs]	78.183 µs (21.2%)
profiling	451.446 µs [429.843 µs, 473.049 µs]	82.678 µs (22.4%)
tracing	442.452 µs [421.953 µs, 462.95 µs]	73.684 µs (20.0%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	370.855 µs [348.657 µs, 393.054 µs]	-
appsec	663.276 µs [642.785 µs, 683.768 µs]	292.421 µs (78.9%)
iast	458.118 µs [437.232 µs, 479.005 µs]	87.263 µs (23.5%)
iast_FULL	531.823 µs [510.974 µs, 552.672 µs]	160.968 µs (43.4%)
iast_INACTIVE	446.173 µs [424.638 µs, 467.709 µs]	75.318 µs (20.3%)
profiling	438.473 µs [417.774 µs, 459.173 µs]	67.618 µs (18.2%)
tracing	446.754 µs [425.433 µs, 468.076 µs]	75.899 µs (20.5%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~bcd9abb27f, baseline=1.20.0-SNAPSHOT~e3aa415c99
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.36 ms) : 1341, 1380
.   : milestone, 1360,
appsec (1.685 ms) : 1661, 1710
.   : milestone, 1685,
iast (1.484 ms) : 1460, 1508
.   : milestone, 1484,
profiling (1.479 ms) : 1455, 1504
.   : milestone, 1479,
tracing (1.445 ms) : 1420, 1470
.   : milestone, 1445,
section candidate
no_agent (1.335 ms) : 1316, 1354
.   : milestone, 1335,
appsec (1.667 ms) : 1642, 1692
.   : milestone, 1667,
iast (1.45 ms) : 1425, 1474
.   : milestone, 1450,
profiling (1.501 ms) : 1475, 1527
.   : milestone, 1501,
tracing (1.439 ms) : 1415, 1463
.   : milestone, 1439,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.36 ms [1.341 ms, 1.38 ms]	-
appsec	1.685 ms [1.661 ms, 1.71 ms]	324.884 µs (23.9%)
iast	1.484 ms [1.46 ms, 1.508 ms]	123.827 µs (9.1%)
profiling	1.479 ms [1.455 ms, 1.504 ms]	119.012 µs (8.7%)
tracing	1.445 ms [1.42 ms, 1.47 ms]	84.919 µs (6.2%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.335 ms [1.316 ms, 1.354 ms]	-
appsec	1.667 ms [1.642 ms, 1.692 ms]	332.109 µs (24.9%)
iast	1.45 ms [1.425 ms, 1.474 ms]	114.807 µs (8.6%)
profiling	1.501 ms [1.475 ms, 1.527 ms]	165.863 µs (12.4%)
tracing	1.439 ms [1.415 ms, 1.463 ms]	104.074 µs (7.8%)

manuel-alvarez-alvarez

Take my review with a grain of salt, I'm no blocking expert and just entered the PR to learn a bit, but looks good to me.

manuel-alvarez-alvarez · 2023-08-10T08:30:20Z

+
+import datadog.trace.bootstrap.instrumentation.decorator.HttpServerDecorator;
+
+public class LibertyDecoratorHolder {


Is this holder needed?, seems it's not used

Thanks, it's a leftover from an earlier version.

manuel-alvarez-alvarez · 2023-08-10T08:32:14Z

+import net.bytebuddy.description.type.TypeDefinition;
+import net.bytebuddy.matcher.ElementMatcher;
+
+public class ArrayOfTypeMatcher<T extends TypeDefinition>


Looks to me that this might be useful in other cases and can be moved alongside the other matchers

I looked into this but it doesn't seem to fit the matchers in package package datadog.trace.agent.tooling.bytebuddy.matcher. They're all rather specialized, including a set of matchers behind an interface there's 3 implementations of.

manuel-alvarez-alvarez · 2023-08-10T08:37:33Z

      request.setAttribute(CorrelationIdentifier.getSpanIdKey(), GlobalTracer.get().getSpanId());

+      if (ActiveSubsystems.APPSEC_ACTIVE) {
+        ContextStore store =


Out of curiosity, is this is a performance improvement to speed up access to the span using the context store instead of the TL?

No, that's not it. This advice is applied to the servlet layer. The span is saved on line 110 above on the request attributes. However, the servlet layer is unreachable on the advice that runs upon response commit, which happens on a lower layer. As such, I have to reach into the guts of the request object for an object that belongs to this lower layer in order to associate the span with it.

manuel-alvarez-alvarez · 2023-08-10T08:41:41Z

+
+  static class HandleExceptionAdvice {
+    @Advice.OnMethodEnter(suppress = Throwable.class, skipOn = Advice.OnNonDefaultValue.class)
+    static boolean /* skip */ before(@Advice.Argument(0) Throwable throwable_) {


Does the skip make sense without an OnMethodExit?

Sure. The return method on the advice serves two purposes. With skipOn it can be used to skip the method body and it can be retrieved on OnMethodExit with @Advice.Enter. In this case I'm only skipping its body; i don't need to do anything on an OnMethodExit like setting the return value (this is a void method being instrumented).

cataphract requested a review from a team as a code owner July 28, 2023 15:34

cataphract added the comp: asm waf Application Security Management (WAF) label Jul 28, 2023

cataphract force-pushed the glopes/liberty-block-resp branch from 19aa36c to a53fefb Compare July 31, 2023 12:58

cataphract requested review from a team and DDJavierSantos August 7, 2023 10:15

manuel-alvarez-alvarez approved these changes Aug 10, 2023

View reviewed changes

cataphract force-pushed the glopes/liberty-block-resp branch 3 times, most recently from 359bfa9 to bcd9abb Compare August 18, 2023 11:52

Response substitution in openliberty

6b07089

cataphract force-pushed the glopes/liberty-block-resp branch from bcd9abb to 6b07089 Compare August 18, 2023 16:59

cataphract enabled auto-merge August 18, 2023 17:04

cataphract merged commit 21e049b into master Aug 18, 2023

cataphract deleted the glopes/liberty-block-resp branch August 18, 2023 17:26

github-actions Bot added this to the 1.20.0 milestone Aug 18, 2023

ValentinZakharov changed the title ~~Response blocking in openliberty~~ Added blocking attacks capability for OpenLiberty Aug 30, 2023

smola changed the title ~~Added blocking attacks capability for OpenLiberty~~ Response blocking in openliberty Jun 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Response blocking in openliberty#5657

Response blocking in openliberty#5657
cataphract merged 1 commit into
masterfrom
glopes/liberty-block-resp

cataphract commented Jul 28, 2023

Uh oh!

pr-commenter Bot commented Jul 28, 2023 •

edited

Loading

Uh oh!

manuel-alvarez-alvarez left a comment

Uh oh!

manuel-alvarez-alvarez Aug 10, 2023

Uh oh!

cataphract Aug 16, 2023

Uh oh!

manuel-alvarez-alvarez Aug 10, 2023

Uh oh!

cataphract Aug 16, 2023

Uh oh!

manuel-alvarez-alvarez Aug 10, 2023

Uh oh!

cataphract Aug 16, 2023 •

edited

Loading

Uh oh!

Uh oh!

manuel-alvarez-alvarez Aug 10, 2023

Uh oh!

cataphract Aug 16, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		import datadog.trace.bootstrap.instrumentation.decorator.HttpServerDecorator;

		public class LibertyDecoratorHolder {

Uh oh!

Conversation

cataphract commented Jul 28, 2023

Uh oh!

pr-commenter Bot commented Jul 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Uh oh!

manuel-alvarez-alvarez left a comment

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarez Aug 10, 2023

Choose a reason for hiding this comment

Uh oh!

cataphract Aug 16, 2023

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarez Aug 10, 2023

Choose a reason for hiding this comment

Uh oh!

cataphract Aug 16, 2023

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarez Aug 10, 2023

Choose a reason for hiding this comment

Uh oh!

cataphract Aug 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

manuel-alvarez-alvarez Aug 10, 2023

Choose a reason for hiding this comment

Uh oh!

cataphract Aug 16, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pr-commenter Bot commented Jul 28, 2023 •

edited

Loading

cataphract Aug 16, 2023 •

edited

Loading