ima-evm-utils: Add --keyid option

Allow user to set signature's keyid using `--keyid' option. Keyid should correspond to SKID in certificate, when keyid is calculated using SHA-1 in libimaevm it may mismatch keyid extracted by the kernel from SKID of certificate (the way public key is presented to the kernel), thus making signatures not verifiable. This may happen when certificate is using non SHA-1 SKID (see rfc7093) or just 'unique number' (see rfc5280 4.2.1.2). As a last resort user may specify arbitrary keyid using the new option.

This commit creates backward compatible ABI change for libimaevm, because of adding additional parameter to imaevm_params - older libimaevm can work with newer client.

Signed-off-by Vitaly Chikunov <[email protected]>

Reported-by Elvira Khabirova <[email protected]>

---
  README                 |  1 +
  src/evmctl.c           | 14 ++++++++++++++
  src/imaevm.h           |  1 +
  src/libimaevm.c        |  8 +++++---
  tests/sign_verify.test |  1 +
  5 files changed, 22 insertions(+), 3 deletions(-)

README +1 -0

index 321045d..8cd66e0 100644
@@ -48,6 +48,7 @@ OPTIONS
        --xattr-user   store xattrs in user namespace (for testing purposes)
        --rsa          use RSA key type and signing scheme v1
    -k, --key          path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)
+      --keyid val    overwrite signature keyid with a value (for signing)
    -o, --portable     generate portable EVM signatures
    -p, --pass         password for encrypted signing key
    -r, --recursive    recurse into directories (sign)

src/evmctl.c +14 -0

index 1815f55..7983299 100644
@@ -2446,6 +2446,7 @@ static void usage(void)
  		"      --xattr-user   store xattrs in user namespace (for testing purposes)\n"
  		"      --rsa          use RSA key type and signing scheme v1\n"
  		"  -k, --key          path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n"
+		"      --keyid val    overwrite signature keyid with a value (for signing)\n"
  		"  -o, --portable     generate portable EVM signatures\n"
  		"  -p, --pass         password for encrypted signing key\n"
  		"  -r, --recursive    recurse into directories (sign)\n"

@@ -2525,6 +2526,7 @@ static struct option opts[] = {
  	{"xattr-user", 0, 0, 140},
  	{"ignore-violations", 0, 0, 141},
  	{"pcrs", 1, 0, 142},
+	{"keyid", 1, 0, 143},
  	{}
 
  };

@@ -2569,6 +2571,8 @@ int main(int argc, char *argv[])
  {
  	int err = 0, c, lind;
  	ENGINE *eng = NULL;
+	unsigned long int keyid;
+	char *eptr;
 
  #if !(OPENSSL_VERSION_NUMBER < 0x10100000)
  	OPENSSL_init_crypto(

@@ -2713,6 +2717,16 @@ int main(int argc, char *argv[])
  			}
  			pcrfile[npcrfile++] = optarg;
  			break;
+		case 143:
+			errno = 0;
+			keyid = strtoul(optarg, &eptr, 16);
+			if (errno || eptr - optarg != strlen(optarg) ||
+			    keyid > UINT_MAX || keyid == 0) {
+				log_err("Invalid keyid value.\n");
+				exit(1);
+			}
+			imaevm_params.keyid = keyid;
+			break;
  		case '?':
  			exit(1);
  			break;

src/imaevm.h +1 -0

index 4503919..9f38059 100644
@@ -196,6 +196,7 @@ struct libimaevm_params {
  	const char *hash_algo;
  	const char *keyfile;
  	const char *keypass;
+	uint32_t keyid;		/* keyid overriding value, unless 0. */
  };
 
  struct RSA_ASN1_template {

src/libimaevm.c +1 -1

index fa6c278..481d29d 100644
@@ -45,6 +45,7 @@
  #include <sys/param.h>
  #include <sys/stat.h>
  #include <asm/byteorder.h>
+#include <arpa/inet.h>
  #include <unistd.h>
  #include <dirent.h>
  #include <string.h>

@@ -894,7 +895,6 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash,
  	const EVP_MD *md;
  	size_t sigsize;
  	const char *st;
-	uint32_t keyid;
 
  	if (!hash) {
  		log_err("sign_hash_v2: hash is null\n");

src/libimaevm.c +2 -0

+	else
+		calc_keyid_v2(&hdr->keyid, name, pkey);
 
  	st = "EVP_PKEY_CTX_new";
  	if (!(ctx = EVP_PKEY_CTX_new(pkey, NULL)))

tests/sign_verify.test +0 -0

index 288e133..2c21812 100755

src/libimaevm.c static int sign_hash_v2(const char *algo, const unsigned char *hash, · line 935

Quoted 7 lines

src/libimaevm.c +2 -2

@@ -932,8 +932,10 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash,
  		return -1;
  	}
-	calc_keyid_v2(&keyid, name, pkey);
-	hdr->keyid = keyid;
+	if (imaevm_params.keyid)
+		hdr->keyid = htonl(imaevm_params.keyid);

Nit: Since existing code uses __be32_to_cpup I would use __cpu_to_be32 here.

Quoted 11 lines

src/libimaevm.c +2 -0

+	else
+		calc_keyid_v2(&hdr->keyid, name, pkey);
  	st = "EVP_PKEY_CTX_new";
  	if (!(ctx = EVP_PKEY_CTX_new(pkey, NULL)))

tests/sign_verify.test +0 -0

index 288e133..2c21812 100755

tests/sign_verify.test sign_verify rsa1024 sha256 0x0301 --rsa · line 365

Quoted 7 lines

tests/sign_verify.test +1 -0

@@ -359,6 +359,7 @@ sign_verify  rsa1024  sha256  0x0301 --rsa
  sign_verify  rsa1024  md5     0x030201:K:0080
  sign_verify  rsa1024  sha1    0x030202:K:0080
  sign_verify  rsa1024  sha224  0x030207:K:0080
+expect_pass check_sign TYPE=ima KEY=rsa1024 ALG=sha256 PREFIX=0x030204aabbccdd0080 OPTS=--keyid=aabbccdd
  sign_verify  rsa1024  sha256  0x030204:K:0080
    try_different_keys
    try_different_sigs

Reviewed-by Stefan Berger <[email protected]>

Stefan,

Quoted 10 lines · Stefan Berger

src/libimaevm.c static int sign_hash_v2(const char *algo, const unsigned char *hash, · line 935

Quoted 7 lines

src/libimaevm.c +2 -2

@@ -932,8 +932,10 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash,
  		return -1;
  	}
-	calc_keyid_v2(&keyid, name, pkey);
-	hdr->keyid = keyid;
+	if (imaevm_params.keyid)
+		hdr->keyid = htonl(imaevm_params.keyid);

Nit: Since existing code uses __be32_to_cpup I would use __cpu_to_be32 here.

That __be32_to_cpup usage is highly dubious. Perhaps, it should be converted to some user-space and standard functions like be32toh(3).

Quoted 14 lines · Vitaly Chikunov

Stefan,

Quoted 10 lines · Stefan Berger

src/libimaevm.c static int sign_hash_v2(const char *algo, const unsigned char *hash, · line 935

Quoted 7 lines

src/libimaevm.c +2 -2

@@ -932,8 +932,10 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash,
  		return -1;
  	}
-	calc_keyid_v2(&keyid, name, pkey);
-	hdr->keyid = keyid;
+	if (imaevm_params.keyid)
+		hdr->keyid = htonl(imaevm_params.keyid);

Nit: Since existing code uses __be32_to_cpup I would use __cpu_to_be32 here.

Quoted 2 lines

That __be32_to_cpup usage is highly dubious. Perhaps, it should be converted to some user-space and standard functions like be32toh(3).

By the way, be32toh() is identical to ntohl().

I wonder what was the reason for the existing code to use these obscure linux-specific functions instead of posix interface described in byteorder(3)?

Signature · 2 lines

-- 
ldv

Allow user to specify `--keyid @/path/to/cert.pem' to extract keyid from SKID of the certificate file. PEM or DER format is auto-detected.

--keyid' option is reused instead of adding a new option (like possible --cert') to signify to the user it's only keyid extraction and nothing more.

Signed-off-by Vitaly Chikunov <[email protected]>

---
  README                 |  1 +
  src/evmctl.c           | 82 +++++++++++++++++++++++++++++++++++++++++++++++---
  tests/sign_verify.test |  1 +
  3 files changed, 79 insertions(+), 5 deletions(-)

README +1 -0

index 8cd66e0..0e1f6ba 100644
@@ -49,6 +49,7 @@ OPTIONS
        --rsa          use RSA key type and signing scheme v1
    -k, --key          path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)
        --keyid val    overwrite signature keyid with a value (for signing)
+                     val is a x509 cert file if prefixed with '@'
    -o, --portable     generate portable EVM signatures
    -p, --pass         password for encrypted signing key
    -r, --recursive    recurse into directories (sign)

src/evmctl.c +23 -0

index 7983299..fdb0fb3 100644
@@ -42,6 +42,7 @@
  #include <sys/param.h>
  #include <sys/stat.h>
  #include <sys/ioctl.h>
+#include <arpa/inet.h>
  #include <fcntl.h>
  #include <unistd.h>
  #include <stdlib.h>

@@ -57,12 +58,14 @@
  #include <termios.h>
  #include <assert.h>
 
+#include <openssl/asn1.h>
  #include <openssl/sha.h>
  #include <openssl/pem.h>
  #include <openssl/hmac.h>
  #include <openssl/err.h>
  #include <openssl/rsa.h>
  #include <openssl/engine.h>
+#include <openssl/x509v3.h>
  #include "hash_info.h"
  #include "pcr.h"
  #include "utils.h"

@@ -2447,6 +2450,7 @@ static void usage(void)
  		"      --rsa          use RSA key type and signing scheme v1\n"
  		"  -k, --key          path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n"
  		"      --keyid val    overwrite signature keyid with a value (for signing)\n"
+		"                     val is a x509 cert file if prefixed with '@'\n"
  		"  -o, --portable     generate portable EVM signatures\n"
  		"  -p, --pass         password for encrypted signing key\n"
  		"  -r, --recursive    recurse into directories (sign)\n"

@@ -2567,12 +2571,71 @@ static char *get_password(void)
  	return pwd;
  }
 
+/* Return true if FILE is possibly PEM encoded (otherwise DER). */
+static int is_encoding_pem(FILE *in)
+{
+	char buf[6]; /* Room for the 5 minus signs and '\0'. */
+	int pem = 0;
+
+	if (fgets(buf, sizeof(buf), in) &&
+	    strspn(buf, "-") == sizeof(buf) - 1)
+		pem = 1;
+	rewind(in);
+	return pem;
+}
+
+/* Extract keyid from SKID of the cert. No return on error. */
+static unsigned long int extract_keyid(const char *certfile)
+{
+	uint32_t keyid_raw;
+	const ASN1_OCTET_STRING *skid;
+	int skid_len;

src/evmctl.c +44 -5

+		x = PEM_read_X509(in, &x, NULL, NULL);
+	else
+		x = d2i_X509_fp(in, &x);
+	if (!x) {
+		ERR_print_errors_fp(stderr);
+		log_err("Cannot read x509 cert from %s file %s\n",
+			pem? "PEM" : "DER", certfile);
+		fclose(in);
+		exit(1);
+	}
+	fclose(in);
+
+	if (!(skid = X509_get0_subject_key_id(x))) {
+		log_err("%s: SKID not found\n", certfile);
+		goto err_free;
+	}
+	skid_len = ASN1_STRING_length(skid);
+	if (skid_len < sizeof(keyid_raw)) {
+		log_err("%s: SKID too short (len %d)\n", certfile, skid_len);
+		goto err_free;
+	}
+	memcpy(&keyid_raw, ASN1_STRING_get0_data(skid) + skid_len
+	       - sizeof(keyid_raw), sizeof(keyid_raw));
+	log_info("keyid %04x (from %s)\n", ntohl(keyid_raw), certfile);
+	return ntohl(keyid_raw);
+
+err_free:
+	X509_free(x);
+	exit(1);
+}
+
  int main(int argc, char *argv[])
  {
  	int err = 0, c, lind;
  	ENGINE *eng = NULL;
  	unsigned long int keyid;
-	char *eptr;
 
  #if !(OPENSSL_VERSION_NUMBER < 0x10100000)
  	OPENSSL_init_crypto(

@@ -2718,10 +2781,19 @@ int main(int argc, char *argv[])
  			pcrfile[npcrfile++] = optarg;
  			break;
  		case 143:
-			errno = 0;
-			keyid = strtoul(optarg, &eptr, 16);
-			if (errno || eptr - optarg != strlen(optarg) ||
-			    keyid > UINT_MAX || keyid == 0) {
+			if (optarg[0] == '@') {
+				keyid = extract_keyid(optarg + 1);
+			} else {
+				char *eptr;
+
+				errno = 0;
+				keyid = strtoul(optarg, &eptr, 16);
+				if (eptr - optarg != strlen(optarg) || errno) {
+					log_err("Invalid keyid value.\n");
+					exit(1);
+				}
+			}
+			if (keyid > UINT_MAX || keyid == 0) {
  				log_err("Invalid keyid value.\n");
  				exit(1);
  			}

tests/sign_verify.test +1 -0

index 2c21812..52ea33a 100755
@@ -360,6 +360,7 @@ sign_verify  rsa1024  md5     0x030201:K:0080
  sign_verify  rsa1024  sha1    0x030202:K:0080
  sign_verify  rsa1024  sha224  0x030207:K:0080
  expect_pass check_sign TYPE=ima KEY=rsa1024 ALG=sha256 PREFIX=0x030204aabbccdd0080 OPTS=--keyid=aabbccdd
+expect_pass check_sign TYPE=ima KEY=rsa1024 ALG=sha256 PREFIX=0x030204:K:0080 [email protected]
  sign_verify  rsa1024  sha256  0x030204:K:0080
    try_different_keys
    try_different_sigs

Quoted 21 lines · Vitaly Chikunov

Allow user to specify `--keyid @/path/to/cert.pem' to extract keyid from SKID of the certificate file. PEM or DER format is auto-detected.

--keyid' option is reused instead of adding a new option (like possible --cert') to signify to the user it's only keyid extraction and nothing more.

Signed-off-by Vitaly Chikunov <[email protected]>

---
  README                 |  1 +
  src/evmctl.c           | 82 +++++++++++++++++++++++++++++++++++++++++++++++---
  tests/sign_verify.test |  1 +
  3 files changed, 79 insertions(+), 5 deletions(-)

src/evmctl.c +6 -0

@@ -2567,12 +2571,71 @@ static char *get_password(void)
+/* Extract keyid from SKID of the cert. No return on error. */
+static unsigned long int extract_keyid(const char *certfile)
+{
+	uint32_t keyid_raw;
+	const ASN1_OCTET_STRING *skid;
+	int skid_len;

src/evmctl.c static char *get_password(void) · line 2586

Quoted 10 lines

src/evmctl.c +10 -0

+	X509 *x = NULL;
+	int pem;
+	FILE *in;
+
+	if (!(in = fopen(certfile, "r"))) {
+		log_err("Cannot open cert file %s: %s\n", certfile,
+			strerror(errno));
+		exit(1);
+	}
+	if ((pem = is_encoding_pem(in)))

I think you should not try to detect PEM by '-----' at the beginning since it typically allows other text at the beginning of the file as well, such as a text dump of the cert. Instead search for '-----BEGIN CERTIFICATE-----' in the whole file or just

try to read it as PEM first and then fall back to DER decoding if PEM failed.

Allow to have certificate appended to the private key of `--key' specified (PEM) file (for v2 signing) to facilitate reading of keyid from the associated cert. This will allow users to have private and public key as a single file. There is no check that public key form the cert matches associated private key.

Signed-off-by Vitaly Chikunov <[email protected]>

---
  README          |  2 ++
  src/libimaevm.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++---
  2 files changed, 49 insertions(+), 3 deletions(-)

README +2 -0

index 0e1f6ba..2c21ba6 100644
@@ -127,6 +127,8 @@ for signing and importing the key.
  Second key format uses X509 DER encoded public key certificates and uses asymmetric key support
  in the kernel (since kernel 3.9). CONFIG_INTEGRITY_ASYMMETRIC_KEYS must be enabled (default).
 
+For v2 signatures x509 certificate with the public key could be appended to the private
+key (both are in PEM format) to properly determine its Subject Key Identifier SKID.
 
  Integrity keyrings
  ----------------

src/libimaevm.c +1 -0

index 481d29d..3607a76 100644
@@ -57,6 +57,7 @@
  #include <openssl/pem.h>
  #include <openssl/evp.h>
  #include <openssl/x509.h>
+#include <openssl/x509v3.h>
  #include <openssl/err.h>
 
  #include "imaevm.h"

Quoted 34 lines · Vitaly Chikunov

Allow to have certificate appended to the private key of `--key' specified (PEM) file (for v2 signing) to facilitate reading of keyid from the associated cert. This will allow users to have private and public key as a single file. There is no check that public key form the cert matches associated private key.

Signed-off-by Vitaly Chikunov <[email protected]>

---
  README          |  2 ++
  src/libimaevm.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++---
  2 files changed, 49 insertions(+), 3 deletions(-)

README +2 -0

index 0e1f6ba..2c21ba6 100644
@@ -127,6 +127,8 @@ for signing and importing the key.
  Second key format uses X509 DER encoded public key certificates and uses asymmetric key support
  in the kernel (since kernel 3.9). CONFIG_INTEGRITY_ASYMMETRIC_KEYS must be enabled (default).
+For v2 signatures x509 certificate with the public key could be appended to the private
+key (both are in PEM format) to properly determine its Subject Key Identifier SKID.
  Integrity keyrings
  ----------------

src/libimaevm.c +1 -0

index 481d29d..3607a76 100644
@@ -57,6 +57,7 @@
  #include <openssl/pem.h>
  #include <openssl/evp.h>
  #include <openssl/x509.h>
+#include <openssl/x509v3.h>
  #include <openssl/err.h>
  #include "imaevm.h"

src/libimaevm.c void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey) · line 753

Quoted 6 lines

src/libimaevm.c +3 -0

@@ -748,6 +749,47 @@ void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey)
  	X509_PUBKEY_free(pk);
  }
+/* Try to read keyid from key file (in case it have appended cert). */
+static int read_keyid(const char *keyfile, uint32_t *keyid)
+{

So the private key is assumed to be in PEM format.

I suppose if there's an
appended X509 in the private key file as well then only one function should be necessary to extract the x509 cert from the files. That function should be able to handle PEM and DER format at the same time. Have you tried extracting the x509 cert from the private key file using that other function in 2/3 yet?

Stefan,

Quoted 34 lines · Stefan Berger

Quoted 33 lines · Vitaly Chikunov

Allow to have certificate appended to the private key of `--key' specified (PEM) file (for v2 signing) to facilitate reading of keyid from the associated cert. This will allow users to have private and public key as a single file. There is no check that public key form the cert matches associated private key.

Signed-off-by Vitaly Chikunov <[email protected]>

---
   README          |  2 ++
   src/libimaevm.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++---
   2 files changed, 49 insertions(+), 3 deletions(-)

README +2 -0

index 0e1f6ba..2c21ba6 100644
@@ -127,6 +127,8 @@ for signing and importing the key.
   Second key format uses X509 DER encoded public key certificates and uses asymmetric key support
   in the kernel (since kernel 3.9). CONFIG_INTEGRITY_ASYMMETRIC_KEYS must be enabled (default).
+For v2 signatures x509 certificate with the public key could be appended to the private
+key (both are in PEM format) to properly determine its Subject Key Identifier SKID.
   Integrity keyrings
   ----------------

src/libimaevm.c +1 -0

index 481d29d..3607a76 100644
@@ -57,6 +57,7 @@
   #include <openssl/pem.h>
   #include <openssl/evp.h>
   #include <openssl/x509.h>
+#include <openssl/x509v3.h>
   #include <openssl/err.h>

Quoted 8 lines

src/libimaevm.c void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey) · line 753

Quoted 7 lines

src/libimaevm.c +3 -0

   #include "imaevm.h"

@@ -748,6 +749,47 @@ void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey)
   	X509_PUBKEY_free(pk);
   }
+/* Try to read keyid from key file (in case it have appended cert). */
+static int read_keyid(const char *keyfile, uint32_t *keyid)
+{

So the private key is assumed to be in PEM format.

Yes, even though README says something different.

Quoted 6 lines

I suppose if there's an
appended X509 in the private key file as well then only one function should be necessary to extract the x509 cert from the files. That function should be able to handle PEM and DER format at the same time. Have you tried extracting the x509 cert from the private key file using that other function in 2/3 yet?

Excuse me, I don't understand what you talking about in this note. 2/3 does not read private keys. Where and why should be one function? And what other function?

Thanks,

Quoted 51 lines · Vitaly Chikunov

Quoted 34 lines · Stefan Berger

Quoted 33 lines · Vitaly Chikunov

Allow to have certificate appended to the private key of `--key' specified (PEM) file (for v2 signing) to facilitate reading of keyid from the associated cert. This will allow users to have private and public key as a single file. There is no check that public key form the cert matches associated private key.

Signed-off-by Vitaly Chikunov <[email protected]>

---
   README          |  2 ++
   src/libimaevm.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++---
   2 files changed, 49 insertions(+), 3 deletions(-)

README +2 -0

index 0e1f6ba..2c21ba6 100644
@@ -127,6 +127,8 @@ for signing and importing the key.
   Second key format uses X509 DER encoded public key certificates and uses asymmetric key support
   in the kernel (since kernel 3.9). CONFIG_INTEGRITY_ASYMMETRIC_KEYS must be enabled (default).
+For v2 signatures x509 certificate with the public key could be appended to the private
+key (both are in PEM format) to properly determine its Subject Key Identifier SKID.
   Integrity keyrings
   ----------------

src/libimaevm.c +1 -0

index 481d29d..3607a76 100644
@@ -57,6 +57,7 @@
   #include <openssl/pem.h>
   #include <openssl/evp.h>
   #include <openssl/x509.h>
+#include <openssl/x509v3.h>
   #include <openssl/err.h>

Quoted 8 lines

src/libimaevm.c void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey) · line 753

Quoted 7 lines

src/libimaevm.c +3 -0

   #include "imaevm.h"

@@ -748,6 +749,47 @@ void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey)
   	X509_PUBKEY_free(pk);
   }
+/* Try to read keyid from key file (in case it have appended cert). */
+static int read_keyid(const char *keyfile, uint32_t *keyid)
+{

So the private key is assumed to be in PEM format.

Yes, even though README says something different.

Quoted 6 lines

I suppose if there's an
appended X509 in the private key file as well then only one function should be necessary to extract the x509 cert from the files. That function should be able to handle PEM and DER format at the same time. Have you tried extracting the x509 cert from the private key file using that other function in 2/3 yet?

Quoted 3 lines

Excuse me, I don't understand what you talking about in this note. 2/3 does not read private keys. Where and why should be one function? And what other function?

It should be possible to combine your  functions extract_keyid (2/3) and read_keyid (3/3) into a single function that can handle PEM files containing X509 certs as well as DER files. It's two times very similar code and the function that can handle DER and PEM should be able to handle PEM files with private keys + X509 certs.

Quoted 13 lines · Stefan Berger

Quoted 11 lines · Vitaly Chikunov

Quoted 7 lines · Stefan Berger

On 5/4/21 12:33 AM, Vitaly Chikunov wrote:
I suppose if there's an
appended X509 in the private key file as well then only one function should be necessary to extract the x509 cert from the files. That function should be able to handle PEM and DER format at the same time. Have you tried extracting the x509 cert from the private key file using that other function in 2/3 yet?

Excuse me, I don't understand what you talking about in this note. 2/3 does not read private keys. Where and why should be one function? And what other function?

Quoted 5 lines

It should be possible to combine your  functions extract_keyid (2/3) and read_keyid (3/3) into a single function that can handle PEM files containing X509 certs as well as DER files. It's two times very similar code and the function that can handle DER and PEM should be able to handle PEM files with private keys + X509 certs.

I see. There should be very generic function that can read fd, FILE, bio, and memory region, also can parse DER, PEM, and combined PEMs.