Load every PEM block when adding root CAs, not just the first

[yosuke-wolfssl]

Problem

The certificate readers added in PR #1140 call wc_CertPemToDer() once, which
decodes the first PEM block and stops. For a host certificate that is correct.
For wolfSSH_CTX_AddRootCert_file() / _buffer() it is a trap: a CA bundle
loads exactly one CA and returns WS_SUCCESS, so trust the caller believes is
installed is not. The outcome also depends on block order — [ca, malformed]
returned WS_SUCCESS, [malformed, ca] returned WS_PARSE_E.

Reachable today: examples/echoserver passes a whole -a caCert file to the
buffer form, as does wolfsshd's UserCAKeysFile.

Fix (src/internal.c)

LoadRootCaPemBuffer() walks every block in a PEM CA buffer:

• wc_PemGetHeaderFooter() supplies the CERTIFICATE header, so text
  between or before blocks is stepped over rather than treated as malformed.
• wc_PemToDer() decodes each block; info.consumed gives the exact block
  length, the same mechanism wolfSSL's own chain loader uses.
• Each DER goes to the existing wolfSSH_CERTMAN_LoadRootCA_buffer().

The walk stops at the first block that will not decode or that the cert
manager refuses, and returns that error. Per-block return codes are unchanged.
No signatures change; UseCert_*, ReadCert_* and the DER paths are untouched.

Behavior change

Bundle	Before	After
[ca, ca]	one CA installed, WS_SUCCESS	both installed, WS_SUCCESS
[ca, malformed]	WS_SUCCESS	WS_BAD_FILE_E
[malformed, ca]	error	unchanged

A trailing malformed block used to be invisible; it now fails the call. On
failure, what the blocks ahead of it left installed is unspecified — wolfSSL
exposes no per-CA unload, so the API cannot promise an empty store. Treat a
failure as a failed load.

Tests

test_wolfSSH_CTX_AddRootCert_bundle() in tests/api.c builds bundles in
memory from the existing keys, covering multi-CA, leading and trailing bad
blocks, interstitial text, and a buffer with no certificate. Guarded on
WOLFSSH_NO_ECDSA like the sibling cert tests.

Verification

• make check: 11 passed, 0 failed, 1 skipped (external).
• Clean under -Werror across 6 GCC configurations.
• ASan + UBSan clean; leak-checked separately (macOS has no LSan) — 0 leaks,
  against 5000 in a negative control with the DER free removed.
• Negative controls: with the walk disabled, the trailing-bad-block assertion
  fails, and in a WOLFSSH_NO_FPKI build a CA in the second block is never
  installed so its leaf fails to verify.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR fixes CA bundle loading so wolfSSH_CTX_AddRootCert_*() processes all PEM certificate blocks in a buffer/file instead of only the first, and adds tests covering multi-block and malformed-bundle behavior.

Changes:

• Add LoadRootCaPemBuffer() to iterate through PEM blocks and load each CA into the cert manager.
• Update wolfSSH_ProcessBuffer() to use the bundle-walking loader for PEM CA buffers.
• Add an API test to validate multi-CA bundles, malformed blocks, and interstitial text behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
wolfssh/ssh.h	Clarifies API behavior for multi-PEM inputs (leaf-only vs CA bundle loading).
tests/api.c	Adds bundle-focused tests and a helper to build multi-block PEM buffers in memory.
src/internal.c	Implements PEM bundle walking for CA loading and wires it into PEM CA processing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1149

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 5
5 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1149

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 4
4 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1149

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 9
9 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1149

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[yosuke-wolfssl]

Hi @ejohnstown ,
This is also one of the follow up.