Bind SCP file timestamps to the open descriptor (fix symlink TOCTOU)

Summary

In the SCP receive path, peer-supplied modification/access times were applied with a path-based utimes() after the destination file was closed. On POSIX, utimes() follows symlinks, so a local process running as the authenticated user could replace the just-written file with a symlink in the window between the close and the timestamp update, redirecting the peer-controlled mTime/aTime onto an arbitrary target inode.

This change binds the timestamp update to the open file descriptor so it can no longer be redirected through the path.

Changes

src/wolfscp.c

• SetTimestampInfo() now takes the open WFILE*. On descriptor-capable platforms it applies the timestamps to the open file:
  • POSIX: futimes(fileno(fp), ...) (via the new WFUTIMES port macro)
  • Windows: _futime(_fileno(fp), ...) instead of re-opening the path
• Buffered file data is flushed before applying the timestamps, so the subsequent fclose() does not write and overwrite the modification time.
• The WOLFSSH_SCP_FILE_DONE handler now applies the timestamp before WFCLOSE on descriptor-capable platforms (WOLFSSH_SCP_FD_UTIMES), and keeps the original after-close path-based update on platforms without a descriptor interface — so no port loses its timestamp to the closing flush.
• Windows branch now null-checks fp, matching the POSIX contract.
• libc return values (futimes/_futime/utimes) are normalized to WS_FATAL_ERROR on failure, consistent with the function's documented WS_SUCCESS/negative contract.

wolfssh/port.h

• Added a descriptor-based WFUTIMES(fd, t) macro, defined only when HAVE_FUTIMES is detected. futimes() is a BSD extension (not POSIX), so gating it avoids implicit-declaration breakage on targets that lack it (Solaris, older Android, strict-standard builds); those fall back to the existing path-based WUTIMES.

configure.ac

• AC_CHECK_FUNCS([... futimes]) so HAVE_FUTIMES is detected per platform.

tests/unit.c

• Added test_ScpRecvCallback_Timestamp, an end-to-end regression test that drives the default receive callback through a full single-file receive and asserts the written file's mtime/atime equal the peer-supplied values.
  When the descriptor path is compiled in, it also pins the flush-before-set ordering. Lives in the internal-symbol unit test (libwolfssh_test).

Platform behavior

Testing

• tests/unit.test — new ScpRecvCallback_Timestamp passes; full suite green under ASan + UBSan (no leak detection on macOS).
• Negative control: removing the pre-flush makes the new test fail (fclose clobbers the modification time), confirming it catches the regression; restoring the fix makes it pass.
• Fallback path: with HAVE_FUTIMES forced off, the build is clean and the path-based after-close update still applies the timestamp correctly.
• End-to-end: OpenSSH scp -p into the wolfSSH echoserver sink — the destination mtime matches the source; before the fix it was the current time.
• scripts/scp.test — all cases pass.
• Production build (--enable-scp, no sanitizers) — clean, no new warnings.