Split SFTP confinement from the start path

[ejohnstown]

• Add wolfSSH_SFTP_SetConfinePath and a separate sftpConfinePath, so the start path only says where a session begins, and only an explicit confinement root rejects out-of-tree requests.
• Have GetAndCleanPath take the WOLFSSH and enforce the confinement root, resolving relative requests against the start path.
• Factor the shared canonicalize-and-store work out of wolfSSH_SFTP_SetDefaultPath into CanonicalizePath and StorePath.
• Give the echoserver -D to opt a session into confinement; without it the -d home directory only says where SFTP starts.
• Document both settings, and the symlink and TOCTOU caveats, once in wolfsftp.h; cover the split in api.c and regress.c.

Issue: ZD-22308

[Copilot]

Pull request overview

This PR separates SFTP “start path” (relative-path base) from an explicit confinement root, so sessions can start in a directory without implicitly being jailed there, and only an explicit confinement root rejects out-of-tree requests.

Changes:

• Adds wolfSSH_SFTP_SetConfinePath() and ssh->sftpConfinePath, and updates path resolution to enforce confinement only when explicitly set.
• Refactors SFTP path canonicalization into shared helpers (CanonicalizePath, StorePath) used by both default/start and confinement setters.
• Updates echoserver (-D) and expands tests to cover the new split semantics and regression behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
wolfssh/wolfsftp.h	Documents the split between start path and confinement root; declares wolfSSH_SFTP_SetConfinePath().
wolfssh/internal.h	Adds sftpConfinePath to session state alongside sftpDefaultPath.
src/wolfsftp.c	Implements confinement root storage, refactors canonicalization, and updates request path cleaning to enforce confinement.
src/internal.c	Frees sftpConfinePath in session teardown.
examples/echoserver/echoserver.c	Adds -D flag to opt into confinement; otherwise -d only sets start path.
tests/regress.c	Updates regress tests to set both start path and confinement root where required.
tests/api.c	Adds tests verifying “start path != confinement” and the independent setters’ behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1167

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 4
4 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[yosuke-wolfssl]

It looks good to me.
The jail root would be given by sftpConfinePath instead of sftpDefaultPath.
It's clearer design than previous one.
Let's give @JacobBarthelmeh a chance to review this as well