known_hosts.c

Go to the documentation of this file.

 
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <fcntl.h>
 
#include <ascii-chat/crypto/known_hosts.h>
#include <ascii-chat/crypto/crypto.h>   // Includes <sodium.h>, CRYPTO_* constants
#include <ascii-chat/common.h>          // For BUFFER_SIZE_* constants
#include <ascii-chat/asciichat_errno.h> // For asciichat_errno system
#include <ascii-chat/crypto/keys.h>
#include <ascii-chat/crypto/regex.h> // For crypto_regex_match_known_hosts()
#include <ascii-chat/util/ip.h>
#include <ascii-chat/platform/util.h>
#include <ascii-chat/platform/system.h>     // For platform_isatty() and FILE_PERM_* constants
#include <ascii-chat/platform/filesystem.h> // For platform_mkdir(), platform_stat()
#include <ascii-chat/platform/question.h>   // For platform_prompt_yes_no
#include <ascii-chat/options/options.h>     // For opt_snapshot_mode
#include <ascii-chat/util/path.h>
#include <ascii-chat/util/string.h>
#include <ascii-chat/tooling/defer/defer.h>
 
// Global variable to cache the expanded known_hosts path
static char *g_known_hosts_path_cache = NULL;
 
const char *get_known_hosts_path(void) {
  // Return cached path if already determined
  if (!g_known_hosts_path_cache) {
    char *config_dir = get_config_dir();
    if (!config_dir) {
      log_error("Failed to determine configuration directory for known_hosts");
      return NULL;
    }
 
    // Build path: config_dir + "known_hosts"
    size_t config_len = strlen(config_dir);
    size_t total_len = config_len + strlen("known_hosts") + 1;
    char *path = SAFE_MALLOC(total_len, char *);
    if (!path) {
      SAFE_FREE(config_dir);
      log_error("Failed to allocate memory for known_hosts path");
      return NULL;
    }
 
    safe_snprintf(path, total_len, "%sknown_hosts", config_dir);
    SAFE_FREE(config_dir);
 
    g_known_hosts_path_cache = path;
    log_debug("KNOWN_HOSTS: Using path %s", g_known_hosts_path_cache);
  }
  return g_known_hosts_path_cache;
}
 
// Format: IP:port x25519 <hex> [comment]
// IPv4 example: 192.0.2.1:8080 x25519 1234abcd... ascii-chat
// IPv6 example: [2001:db8::1]:8080 x25519 1234abcd... ascii-chat
asciichat_error_t check_known_host(const char *server_ip, uint16_t port, const uint8_t server_key[32]) {
  // Validate parameters first
  if (!server_ip || !server_key) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters: server_ip=%p, server_key=%p", server_ip, server_key);
  }
 
  // Format IP:port with proper bracket notation for IPv6
  char ip_with_port[BUFFER_SIZE_MEDIUM];
  if (format_ip_with_port(server_ip, port, ip_with_port, sizeof(ip_with_port)) != ASCIICHAT_OK) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid IP format: %s", server_ip);
  }
 
  // Add space after IP:port for prefix matching
  char expected_prefix[BUFFER_SIZE_MEDIUM];
  safe_snprintf(expected_prefix, sizeof(expected_prefix), "%s ", ip_with_port);
 
  // Use platform abstraction to find all known_hosts files across standard locations
  // Append semantics: search ALL files for matching entries (user + system)
  config_file_list_t known_hosts_files = {0};
  asciichat_error_t search_result = platform_find_config_file("known_hosts", &known_hosts_files);
 
  if (search_result != ASCIICHAT_OK) {
    // Platform search failed - non-fatal, treat as unknown host
    log_debug("KNOWN_HOSTS: Failed to search for known_hosts files: %d", search_result);
    return ASCIICHAT_OK;
  }
 
  // If no files found, this is an unknown host (first connection)
  if (known_hosts_files.count == 0) {
    return ASCIICHAT_OK;
  }
 
  // Search through ALL known_hosts files for matching entry (append semantics)
  bool found_entries = false;
  for (size_t file_idx = 0; file_idx < known_hosts_files.count; file_idx++) {
    const char *path = known_hosts_files.files[file_idx].path;
 
    int fd = platform_open(path, PLATFORM_O_RDONLY, FILE_PERM_PRIVATE);
    if (fd < 0) {
      log_debug("KNOWN_HOSTS: Cannot open file: %s", path);
      continue; // Skip files that can't be opened
    }
 
    FILE *f = platform_fdopen(fd, "r");
    if (!f) {
      platform_close(fd);
      log_debug("KNOWN_HOSTS: Failed to fdopen: %s", path);
      continue;
    }
 
    char line[BUFFER_SIZE_XLARGE];
 
    // Search this file for matching IP:port entries
    while (fgets(line, sizeof(line), f)) {
      if (line[0] == '#')
        continue; // Comment
 
      // Use regex to parse and extract known_hosts line components
      char *parsed_ip_port = NULL, *parsed_key_type = NULL, *parsed_hex_key = NULL, *parsed_comment = NULL;
      if (!crypto_regex_match_known_hosts(line, &parsed_ip_port, &parsed_key_type, &parsed_hex_key, &parsed_comment)) {
        continue; // Line doesn't match known_hosts format
      }
 
      // Check if IP:port matches what we're looking for (with IPv6 normalization)
      if (!compare_ip_port_strings(parsed_ip_port, ip_with_port)) {
        SAFE_FREE(parsed_ip_port);
        SAFE_FREE(parsed_key_type);
        SAFE_FREE(parsed_hex_key);
        SAFE_FREE(parsed_comment);
        continue; // Different IP:port
      }
 
      found_entries = true;
 
      if (strcmp(parsed_key_type, NO_IDENTITY_MARKER) == 0) {
        // No-identity entry but server has identity - continue searching
        log_debug("SECURITY_DEBUG: Found no-identity entry, but server has identity key");
        SAFE_FREE(parsed_ip_port);
        SAFE_FREE(parsed_key_type);
        SAFE_FREE(parsed_hex_key);
        SAFE_FREE(parsed_comment);
        continue;
      }
 
      // Parse identity key from hex string
      if (!parsed_hex_key) {
        // No hex key found - invalid entry
        SAFE_FREE(parsed_ip_port);
        SAFE_FREE(parsed_key_type);
        SAFE_FREE(parsed_comment);
        continue;
      }
 
      public_key_t stored_key;
      if (parse_public_key(parsed_hex_key, &stored_key) != 0) {
        SAFE_FREE(parsed_ip_port);
        SAFE_FREE(parsed_key_type);
        SAFE_FREE(parsed_hex_key);
        SAFE_FREE(parsed_comment);
        continue; // Invalid key format
      }
 
      // Check if server key is all zeros (no-identity server)
      bool server_key_is_zero = true;
      for (int i = 0; i < ED25519_PUBLIC_KEY_SIZE; i++) {
        if (server_key[i] != 0) {
          server_key_is_zero = false;
          break;
        }
      }
 
      // Check if stored key is all zeros
      bool stored_key_is_zero = true;
      for (int i = 0; i < ED25519_PUBLIC_KEY_SIZE; i++) {
        if (stored_key.key[i] != 0) {
          stored_key_is_zero = false;
          break;
        }
      }
 
      // Both zero = no-identity connection (weaker security)
      if (server_key_is_zero && stored_key_is_zero) {
        log_warn("SECURITY: Connecting to no-identity server at known IP:port");
        SAFE_FREE(parsed_ip_port);
        SAFE_FREE(parsed_key_type);
        SAFE_FREE(parsed_hex_key);
        SAFE_FREE(parsed_comment);
        fclose(f);
        config_file_list_destroy(&known_hosts_files);
        return 1; // Match found
      }
 
      // Compare keys (constant-time)
      if (sodium_memcmp(server_key, stored_key.key, ED25519_PUBLIC_KEY_SIZE) == 0) {
        log_info("SECURITY: Server key matches known_hosts - connection verified");
        SAFE_FREE(parsed_ip_port);
        SAFE_FREE(parsed_key_type);
        SAFE_FREE(parsed_hex_key);
        SAFE_FREE(parsed_comment);
        fclose(f);
        config_file_list_destroy(&known_hosts_files);
        return 1; // Match found!
      }
 
      // Key mismatch - free and continue searching
      SAFE_FREE(parsed_ip_port);
      SAFE_FREE(parsed_key_type);
      SAFE_FREE(parsed_hex_key);
      SAFE_FREE(parsed_comment);
    }
 
    fclose(f);
  }
 
  config_file_list_destroy(&known_hosts_files);
 
  // Check if we found any entries at all
  if (found_entries) {
    // We found entries for this IP:port but none matched the server key
    // This is a MITM warning!
    log_error("SECURITY: Server key does NOT match any known_hosts entries!");
    log_error("SECURITY: This indicates a possible man-in-the-middle attack!");
    return ERROR_CRYPTO_VERIFICATION;
  }
 
  // No entries found for this IP:port - first connection
  return ASCIICHAT_OK;
}
 
// Check known_hosts for servers without identity key (no-identity entries)
// Returns: 1 = previously accepted known host (no-identity entry found),
// ASCIICHAT_OK = unknown host (first connection),
// ERROR_CRYPTO_VERIFICATION = server changed from identity to no-identity
asciichat_error_t check_known_host_no_identity(const char *server_ip, uint16_t port) {
  const char *path = get_known_hosts_path();
  int fd = platform_open(path, PLATFORM_O_RDONLY, FILE_PERM_PRIVATE);
  if (fd < 0) {
    // File doesn't exist - this is an unknown host that needs verification
    log_warn("Known hosts file does not exist: %s", path);
    return ASCIICHAT_OK; // Return 0 to indicate unknown host (first connection)
  }
 
  FILE *f = platform_fdopen(fd, "r");
  defer(SAFE_FCLOSE(f));
  if (!f) {
    // Failed to open file descriptor as FILE*
    platform_close(fd);
    log_warn("Failed to open known hosts file: %s", path);
    return ASCIICHAT_OK; // Return 0 to indicate unknown host (first connection)
  }
 
  char line[BUFFER_SIZE_XLARGE];
  char expected_prefix[BUFFER_SIZE_MEDIUM];
 
  // Format IP:port with proper bracket notation for IPv6
  char ip_with_port[BUFFER_SIZE_MEDIUM];
  if (format_ip_with_port(server_ip, port, ip_with_port, sizeof(ip_with_port)) != ASCIICHAT_OK) {
 
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid IP format: %s", server_ip);
  }
 
  // Add space after IP:port for prefix matching
  safe_snprintf(expected_prefix, sizeof(expected_prefix), "%s ", ip_with_port);
 
  while (fgets(line, sizeof(line), f)) {
    if (line[0] == '#')
      continue; // Comment
 
    // Use regex to parse and extract known_hosts line components
    char *parsed_ip_port = NULL, *parsed_key_type = NULL, *parsed_hex_key = NULL, *parsed_comment = NULL;
    if (!crypto_regex_match_known_hosts(line, &parsed_ip_port, &parsed_key_type, &parsed_hex_key, &parsed_comment)) {
      continue; // Line doesn't match known_hosts format
    }
 
    // Check if IP:port matches what we're looking for (with IPv6 normalization)
    if (!compare_ip_port_strings(parsed_ip_port, ip_with_port)) {
      SAFE_FREE(parsed_ip_port);
      SAFE_FREE(parsed_key_type);
      SAFE_FREE(parsed_hex_key);
      SAFE_FREE(parsed_comment);
      continue; // Different IP:port
    }
 
    // Found matching IP:port - check key type
    if (strcmp(parsed_key_type, "no-identity") == 0) {
      // This is a server without identity key that was previously accepted by the user
      // No warnings or user confirmation needed - user already accepted this server
      SAFE_FREE(parsed_ip_port);
      SAFE_FREE(parsed_key_type);
      SAFE_FREE(parsed_hex_key);
      SAFE_FREE(parsed_comment);
      return 1; // Known host (no-identity entry) - secure connection
    }
 
    // If we found a normal identity key entry, this is a mismatch
    // Server previously had identity key but now has none
    log_warn("Server previously had identity key but now has none - potential security issue");
    SAFE_FREE(parsed_ip_port);
    SAFE_FREE(parsed_key_type);
    SAFE_FREE(parsed_hex_key);
    SAFE_FREE(parsed_comment);
    return ERROR_CRYPTO_VERIFICATION; // Mismatch - server changed from identity to no-identity
  }
 
  return ASCIICHAT_OK; // Not found = first connection
}
 
static asciichat_error_t mkdir_recursive(const char *path) {
  if (!path || !*path) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid path for mkdir_recursive");
  }
 
  // Make a mutable copy of the path
  size_t len = strlen(path);
  char *tmp = SAFE_MALLOC(len + 1, char *);
  defer(SAFE_FREE(tmp));
  if (!tmp) {
    return SET_ERRNO(ERROR_MEMORY, "Failed to allocate memory for path");
  }
  memcpy(tmp, path, len + 1);
 
  // Handle absolute paths (skip leading / or drive letter on Windows)
  char *p = tmp;
#ifdef _WIN32
  // Skip drive letter (e.g., "C:")
  if (len >= 2 && tmp[1] == ':') {
    p += 2;
  }
#endif
  // Skip leading separators (handle both / and \ on all platforms)
  while (*p == '/' || *p == '\\') {
    p++;
  }
 
  // Create directories one level at a time
  for (; *p; p++) {
    if (*p == '/' || *p == '\\') {
      *p = '\0'; // Temporarily truncate
 
      // Try to create this directory level using platform abstraction
      asciichat_error_t mkdir_result = platform_mkdir(tmp, DIR_PERM_PRIVATE);
      if (mkdir_result != ASCIICHAT_OK) {
        return mkdir_result;
      }
 
      *p = PATH_DELIM; // Restore path separator (use platform-specific separator)
    }
  }
 
  // Create the final directory using platform abstraction
  asciichat_error_t mkdir_result = platform_mkdir(tmp, DIR_PERM_PRIVATE);
  if (mkdir_result != ASCIICHAT_OK) {
    return mkdir_result;
  }
 
  return ASCIICHAT_OK;
}
 
asciichat_error_t add_known_host(const char *server_ip, uint16_t port, const uint8_t server_key[32]) {
  // Validate parameters first
  if (!server_ip || !server_key) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameters: server_ip=%p, server_key=%p", server_ip, server_key);
  }
 
  // Check for empty string (must be after NULL check)
  size_t ip_len = strlen(server_ip);
  if (ip_len == 0) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Empty hostname/IP");
  }
 
  const char *path = get_known_hosts_path();
  if (!path || path[0] == '\0') {
    SET_ERRNO(ERROR_CONFIG, "Failed to get known hosts file path");
    return ERROR_CONFIG;
  }
 
  // Create parent directories recursively (like mkdir -p)
  size_t path_len = strlen(path);
  if (path_len == 0) {
    SET_ERRNO(ERROR_CONFIG, "Empty known hosts file path");
    return ERROR_CONFIG;
  }
  char *dir = SAFE_MALLOC(path_len + 1, char *);
  defer(SAFE_FREE(dir));
  if (!dir) {
    SET_ERRNO(ERROR_MEMORY, "Failed to allocate memory for directory path");
    return ERROR_MEMORY;
  }
  memcpy(dir, path, path_len + 1);
 
  // Find the last path separator
  char *last_sep = strrchr(dir, PATH_DELIM);
 
  if (last_sep) {
    *last_sep = '\0'; // Truncate to get directory path
    asciichat_error_t result = mkdir_recursive(dir);
    if (result != ASCIICHAT_OK) {
      return result; // Error already set by mkdir_recursive
    }
  }
 
  // Create the file if it doesn't exist, then append to it
  // Note: Temporarily removed log_debug to avoid potential crashes during debugging
  // log_debug("KNOWN_HOSTS: Attempting to create/open file: %s", path);
  // Use "a" mode for append-only (simpler and works better with chmod)
  FILE *f = platform_fopen(path, "a");
  defer(SAFE_FCLOSE(f));
  if (!f) {
    // log_debug("KNOWN_HOSTS: platform_fopen failed: %s (errno=%d)", SAFE_STRERROR(errno), errno);
    return SET_ERRNO_SYS(ERROR_CONFIG, "Failed to create/open known hosts file: %s", path);
  }
  // Set secure permissions (0600) - only owner can read/write
  // Note: chmod may fail if file was just created by fopen, but that's okay
  (void)platform_chmod(path, FILE_PERM_PRIVATE);
  // log_debug("KNOWN_HOSTS: Successfully opened file: %s", path);
 
  // Format IP:port with proper bracket notation for IPv6
  char ip_with_port[BUFFER_SIZE_MEDIUM];
  if (format_ip_with_port(server_ip, port, ip_with_port, sizeof(ip_with_port)) != ASCIICHAT_OK) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid IP format: %s", server_ip);
  }
 
  // Convert key to hex for storage
  char hex[CRYPTO_HEX_KEY_SIZE_NULL] = {0}; // Initialize to zeros for safety
  bool is_placeholder = true;
  // Build hex string byte by byte to avoid buffer overflow issues
  for (int i = 0; i < ED25519_PUBLIC_KEY_SIZE; i++) {
    // Convert each byte to 2 hex digits directly
    uint8_t byte = server_key[i];
    hex[i * 2] = "0123456789abcdef"[byte >> 4];      // High nibble
    hex[i * 2 + 1] = "0123456789abcdef"[byte & 0xf]; // Low nibble
    if (byte != 0) {
      is_placeholder = false;
    }
  }
  hex[CRYPTO_HEX_KEY_SIZE] = '\0'; // Ensure null termination (64 hex digits + null terminator)
 
  // Write to file and check for errors
  int fprintf_result;
  if (is_placeholder) {
    // Server has no identity key - store as placeholder
    fprintf_result = safe_fprintf(f, "%s %s 0000000000000000000000000000000000000000000000000000000000000000 %s\n",
                                  ip_with_port, NO_IDENTITY_MARKER, ASCII_CHAT_APP_NAME);
  } else {
    // Server has identity key - store normally
    fprintf_result = safe_fprintf(f, "%s %s %s %s\n", ip_with_port, X25519_KEY_TYPE, hex, ASCII_CHAT_APP_NAME);
  }
 
  // Check if fprintf failed
  if (fprintf_result < 0) {
    return SET_ERRNO_SYS(ERROR_CONFIG, "CRITICAL SECURITY ERROR: Failed to write to known_hosts file: %s", path);
  }
 
  // Flush to ensure data is written
  if (fflush(f) != 0) {
    return SET_ERRNO_SYS(ERROR_CONFIG, "CRITICAL SECURITY ERROR: Failed to flush known_hosts file: %s", path);
  }
 
  log_debug("KNOWN_HOSTS: Successfully added host to known_hosts file: %s", path);
 
  return ASCIICHAT_OK;
}
 
asciichat_error_t remove_known_host(const char *server_ip, uint16_t port) {
  // Validate parameters first
  if (!server_ip) {
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid parameter: server_ip=%p", server_ip);
  }
 
  const char *path = get_known_hosts_path();
  int fd = platform_open(path, PLATFORM_O_RDONLY, FILE_PERM_PRIVATE);
  if (fd < 0) {
    // File doesn't exist - nothing to remove, return success
    return ASCIICHAT_OK;
  }
  FILE *f = platform_fdopen(fd, "r");
  defer(SAFE_FCLOSE(f));
  if (!f) {
    platform_close(fd);
    SET_ERRNO_SYS(ERROR_CONFIG, "Failed to open known hosts file: %s", path);
    return ERROR_CONFIG;
  }
 
  // Format IP:port with proper bracket notation for IPv6
  char ip_with_port[BUFFER_SIZE_MEDIUM];
  if (format_ip_with_port(server_ip, port, ip_with_port, sizeof(ip_with_port)) != ASCIICHAT_OK) {
 
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid IP format: %s", server_ip);
  }
 
  // Read all lines into memory
  char **lines = NULL;
  size_t num_lines = 0;
  defer({
    if (lines) {
      for (size_t i = 0; i < num_lines; i++) {
        SAFE_FREE(lines[i]);
      }
    }
    SAFE_FREE(lines);
  });
  char line[BUFFER_SIZE_XLARGE];
 
  char expected_prefix[BUFFER_SIZE_MEDIUM];
  safe_snprintf(expected_prefix, sizeof(expected_prefix), "%s ", ip_with_port);
 
  while (fgets(line, sizeof(line), f)) {
    // Skip lines that match this IP:port
    if (strncmp(line, expected_prefix, strlen(expected_prefix)) != 0) {
      // Keep this line
      char **new_lines = SAFE_REALLOC((void *)lines, (num_lines + 1) * sizeof(char *), char **);
      if (new_lines) {
        lines = new_lines;
        lines[num_lines] = platform_strdup(line);
        if (lines[num_lines] == NULL) {
          return SET_ERRNO(ERROR_MEMORY, "Failed to duplicate line from known_hosts file");
        }
        num_lines++;
      }
    }
  }
  // Close first file before opening for write
  if (f) {
    fclose(f);
    f = NULL; // Prevent double-close by defer
  }
 
  // Write back the filtered lines
  fd = platform_open(path, PLATFORM_O_WRONLY | PLATFORM_O_CREAT | PLATFORM_O_TRUNC, FILE_PERM_PRIVATE);
  f = platform_fdopen(fd, "w");
  if (!f) {
    // Cleanup on error - fdopen failed, so fd is still open but f is NULL
    // Individual line strings will be freed by defer cleanup
    platform_close(fd); // Close fd directly since fdopen failed
    return SET_ERRNO_SYS(ERROR_CONFIG, "Failed to open known hosts file: %s", path);
  }
 
  for (size_t i = 0; i < num_lines; i++) {
    (void)fputs(lines[i], f);
  }
  // All cleanup (lines, individual strings, file handle) handled by defer statements
 
  log_debug("KNOWN_HOSTS: Successfully removed host from known_hosts file: %s", path);
  return ASCIICHAT_OK;
}
 
// Compute SHA256 fingerprint of key for display
void compute_key_fingerprint(const uint8_t key[ED25519_PUBLIC_KEY_SIZE], char fingerprint[CRYPTO_HEX_KEY_SIZE_NULL]) {
  uint8_t hash[HMAC_SHA256_SIZE];
  crypto_hash_sha256(hash, key, ED25519_PUBLIC_KEY_SIZE);
 
  // Build hex string byte by byte to avoid buffer overflow issues
  for (int i = 0; i < HMAC_SHA256_SIZE; i++) {
    uint8_t byte = hash[i];
    fingerprint[i * 2] = "0123456789abcdef"[byte >> 4];      // High nibble
    fingerprint[i * 2 + 1] = "0123456789abcdef"[byte & 0xf]; // Low nibble
  }
  fingerprint[CRYPTO_HEX_KEY_SIZE] = '\0';
}
 
// Interactive prompt for unknown host - returns true if user wants to add, false to abort
bool prompt_unknown_host(const char *server_ip, uint16_t port, const uint8_t server_key[32]) {
  char fingerprint[CRYPTO_HEX_KEY_SIZE_NULL];
  compute_key_fingerprint(server_key, fingerprint);
 
  // Format IP:port with proper bracket notation for IPv6
  char ip_with_port[BUFFER_SIZE_MEDIUM];
  if (format_ip_with_port(server_ip, port, ip_with_port, sizeof(ip_with_port)) != ASCIICHAT_OK) {
    // Fallback to basic format if error
    safe_snprintf(ip_with_port, sizeof(ip_with_port), "%s:%u", server_ip, port);
  }
 
  // Check if we're running interactively (stdin is a terminal and not in snapshot mode)
  const char *env_skip_known_hosts_checking = platform_getenv("ASCII_CHAT_INSECURE_NO_HOST_IDENTITY_CHECK");
  if (env_skip_known_hosts_checking && strcmp(env_skip_known_hosts_checking, STR_ONE) == 0) {
    log_warn("Skipping known_hosts checking. This is a security vulnerability.");
    return true;
  }
#ifndef NDEBUG
  // In debug builds, also skip for Claude Code (LLM automation can't do interactive prompts)
  const char *env_claudecode = platform_getenv("CLAUDECODE");
  if (env_claudecode && strlen(env_claudecode) > 0) {
    log_warn("Skipping known_hosts checking (CLAUDECODE set in debug build).");
    return true;
  }
#endif
  if (!terminal_can_prompt_user()) {
    // SECURITY: Non-interactive mode - REJECT unknown hosts to prevent MITM attacks
    SET_ERRNO(ERROR_CRYPTO, "SECURITY: Cannot verify unknown host in non-interactive mode");
    log_error("ERROR: Cannot verify unknown host in non-interactive mode without environment variable bypass.\n"
              "This connection may be a man-in-the-middle attack!\n"
              "\n"
              "To connect to this host:\n"
              "  1. Run the client interactively (from a terminal with TTY)\n"
              "  2. Verify the fingerprint: SHA256:%s\n"
              "  3. Accept the host when prompted\n"
              "  4. The host will be added to: %s\n"
              "\n"
              "Connection aborted for security.\n"
              "To bypass this check, set the environment variable ASCII_CHAT_INSECURE_NO_HOST_IDENTITY_CHECK to 1",
              fingerprint, get_known_hosts_path());
    return false; // REJECT unknown hosts in non-interactive mode
  }
 
  // Interactive mode - prompt user
  // Lock terminal so only this thread can output to terminal
  // Other threads' logs are buffered until we unlock
  bool previous_terminal_state = log_lock_terminal();
 
  log_plain("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n"
            "@    WARNING: REMOTE HOST IDENTIFICATION NOT KNOWN!      @\n"
            "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n"
            "\n"
            "The authenticity of host '%s' can't be established.\n"
            "Ed25519 key fingerprint is SHA256:%s\n",
            ip_with_port, fingerprint);
 
  // Unlock before prompt (prompt_yes_no handles its own terminal locking)
  log_unlock_terminal(previous_terminal_state);
 
  // Prompt user - default is No for security
  if (platform_prompt_yes_no("Are you sure you want to continue connecting", false)) {
    log_warn("Warning: Permanently added '%s' to the list of known hosts.", ip_with_port);
    return true;
  }
 
  log_warn("Connection aborted by user.");
  return false;
}
 
// Display MITM warning with key comparison and prompt user for confirmation
// Returns true if user accepts the risk and wants to continue, false otherwise
bool display_mitm_warning(const char *server_ip, uint16_t port, const uint8_t expected_key[32],
                          const uint8_t received_key[32]) {
  char expected_fp[CRYPTO_HEX_KEY_SIZE_NULL], received_fp[CRYPTO_HEX_KEY_SIZE_NULL];
  compute_key_fingerprint(expected_key, expected_fp);
  compute_key_fingerprint(received_key, received_fp);
 
  const char *known_hosts_path = get_known_hosts_path();
 
  // Format IP:port with proper bracket notation for IPv6
  char ip_with_port[BUFFER_SIZE_MEDIUM];
  if (format_ip_with_port(server_ip, port, ip_with_port, sizeof(ip_with_port)) != ASCIICHAT_OK) {
    // Fallback to basic format if error
    safe_snprintf(ip_with_port, sizeof(ip_with_port), "%s:%u", server_ip, port);
  }
 
  char escaped_ip_with_port[128];
  escape_ascii(ip_with_port, "[]", escaped_ip_with_port, 128);
  log_warn("\n"
           "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n"
           "@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @\n"
           "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n"
           "\n"
           "IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!\n"
           "Someone could be eavesdropping on you right now (man-in-the-middle attack)!\n"
           "It is also possible that the host key has just been changed.\n"
           "\n"
           "The fingerprint for the Ed25519 key sent by the remote host is:\n"
           "SHA256:%s\n"
           "\n"
           "Expected fingerprint:\n"
           "SHA256:%s\n"
           "\n"
           "Please contact your system administrator.\n"
           "\n"
           "Add correct host key in %s to get rid of this message.\n"
           "Offending key for IP address %s was found at:\n"
           "%s\n"
           "\n"
           "To update the key, run:\n"
           "  # Linux/macOS:\n"
           "    sed -i '' '/%s /d' ~/.ascii-chat/known_hosts\n"
           "    # or run this instead:\n"
           "    cat ~/.ascii-chat/known_hosts | grep -v '%s ' > /tmp/x; cp /tmp/x ~/.ascii-chat/known_hosts\n"
           "  # Windows PowerShell:\n"
           "    (Get-Content ~/.ascii-chat/known_hosts) | Where-Object { $_ -notmatch '^%s ' } | Set-Content "
           "~/.ascii-chat/known_hosts\n"
           "  # Or manually edit ~/.ascii-chat/known_hosts to remove lines starting with '%s '\n"
           "\n"
           "Host key verification failed.\n"
           "\n",
           received_fp, expected_fp, known_hosts_path, ip_with_port, known_hosts_path, ip_with_port,
           escaped_ip_with_port, ip_with_port, ip_with_port);
 
  return false;
}
 
static bool is_localhost_address(const char *ip_string) {
  if (!ip_string) {
    return false;
  }
 
  // Use robust IP utility functions that properly validate
  // IPv4: Checks entire 127.0.0.0/8 range with proper validation
  // IPv6: Handles ::1, [::1], and expanded forms like 0:0:0:0:0:0:0:1
  return is_localhost_ipv4(ip_string) || is_localhost_ipv6(ip_string);
}
 
static bool is_automated_mode(void) {
  // Check for Claude Code automation
  const char *claudecode = SAFE_GETENV("CLAUDECODE");
  if (claudecode && strlen(claudecode) > 0) {
    return true;
  }
 
  // Check for insecure bypass environment variable
  const char *insecure_bypass = SAFE_GETENV("ASCII_CHAT_INSECURE_NO_HOST_IDENTITY_CHECK");
  if (insecure_bypass && strcmp(insecure_bypass, "1") == 0) {
    return true;
  }
 
  // Check if user prompts are possible (TTY + not snapshot + not automated)
  if (!terminal_can_prompt_user()) {
    return true; // Skip interactive prompts in non-interactive environments
  }
 
  return false;
}
 
// Interactive prompt for unknown host without identity key
// Returns true if user wants to continue, false to abort
bool prompt_unknown_host_no_identity(const char *server_ip, uint16_t port) {
  // Format IP:port with proper bracket notation for IPv6
  char ip_with_port[BUFFER_SIZE_MEDIUM];
  if (format_ip_with_port(server_ip, port, ip_with_port, sizeof(ip_with_port)) != ASCIICHAT_OK) {
    // Fallback to basic format if error
    safe_snprintf(ip_with_port, sizeof(ip_with_port), "%s:%u", server_ip, port);
  }
 
  // LOCALHOST OPTIMIZATION: Skip authentication prompt for localhost addresses
  // Localhost is inherently trusted (same machine, no network exposure)
  // This matches SSH behavior (ssh-keyscan doesn't prompt for localhost)
  if (is_localhost_address(server_ip)) {
    log_debug(
        "SECURITY: Localhost address %s detected - skipping unknown host prompt (localhost is inherently trusted)",
        ip_with_port);
    return true; // Silently trust localhost
  }
 
  // Check if running in automated/non-interactive environment
  // In debug builds, Claude Code automation can't interact with prompts
  if (is_automated_mode()) {
    SET_ERRNO(ERROR_CRYPTO, "SECURITY: Cannot verify server without identity key in non-interactive/automated mode");
    log_error("ERROR: Cannot verify server without identity key in non-interactive/automated mode.\n"
              "ERROR: This connection is vulnerable to man-in-the-middle attacks!\n"
              "\n"
              "To connect to this host:\n"
              "  1. Run the client interactively (from a terminal with TTY)\n"
              "  2. Verify you trust this server despite no identity key\n"
              "  3. Accept the risk when prompted\n"
              "  OR better: Ask server admin to use --key for proper authentication\n"
              "\n"
              "Connection aborted for security.\n"
              "\n");
    return false;
  }
 
  log_warn("\n"
           "The authenticity of host '%s' can't be established.\n"
           "The server has no identity key to verify its authenticity.\n"
           "\n"
           "WARNING: This connection is vulnerable to man-in-the-middle attacks!\n"
           "Anyone can intercept your connection and read your data.\n"
           "\n"
           "To secure this connection:\n"
           "  1. Server should use --key to provide an identity key\n"
           "  2. Client should use --server-key to verify the server\n"
           "\n",
           ip_with_port);
 
  // Interactive mode - prompt user (default is No for security)
  if (platform_prompt_yes_no("Are you sure you want to continue connecting", false)) {
    log_warn("Warning: Proceeding with unverified connection.\n"
             "Your data may be intercepted by attackers!\n"
             "\n");
    return true;
  }
 
  log_plain("Connection aborted by user.");
  return false;
}
 
// Cleanup function to free the cached known_hosts path
void known_hosts_destroy(void) {
  if (g_known_hosts_path_cache) {
    SAFE_FREE(g_known_hosts_path_cache);
    g_known_hosts_path_cache = NULL;
  }
}