Description

wolfSSH_SFTP_RecvOpen checked a target's type with stat() (follows symlinks) and then opened it with open() lacking O_NOFOLLOW. A symlink whose leaf points at a regular file passed the FILEATRB_PER_FILE type check, and open() then followed it to the target — a confused-deputy read/write of any file the daemon can reach, plus a TOCTOU race on the final path component.
Addressed by f_4792.

Changes

Harden the open sink, scoped to confined sessions so behavior is unchanged for unconfined servers (which follow symlinks by default):

• RecvOpen now computes a confined flag via a new SFTP_SessionConfined() helper and, only when confined:
  • passes noFollow=1 to SFTP_GetAttributes, so POSIX uses lstat() and a symlink leaf is reported as FILEATRB_PER_LINK and rejected;
  • ORs O_NOFOLLOW into the open flags, closing the final-component TOCTOU window.
• New portable WOLFSSH_O_NOFOLLOW macro in port.h (O_NOFOLLOW on POSIX where available, 0 no-op fallback elsewhere), guarded with #ifdef O_NOFOLLOW so POSIX targets lacking it degrade gracefully.
• The confinement gate (trailing-separator-stripped default-path length > 1) is factored into a single SFTP_ConfinedPathLen() helper shared by GetAndCleanPath and SFTP_SessionConfined, so the two stay in sync.
• New test for positive/negative cases