Re: enforcing tls1.3 no-sni in unbound, or globally

On Tue, Jul 14, 2026 at 12:11:30PM -0700, Philip Guenther wrote:

>I suggest that because the version number in a TLSv1.3 client hello is
>actually “1.2” for middlebox compatibility; cf rfc8446 section 4.1.2.  I’m
>not familiar with whether or how tshark displays the *real* version number.

Yep, I saw that with -V (too much to paste here)

Right now, I'm not seeing anything SNI-wise for dns-tls, imaps or ssmtp. I only see it
when using e.g. lynx:

% doas tshark -r tls-versions-test5.pcap -Y "tcp.port == 443 && tls.handshake.type==1 \
&& tls.handshake.extensions_server_name"

1290  56.042036 192.168.1.199 ? 104.16.124.96 TLSv1.2 210 Client Hello (SNI=www.cloudflare.com)
1950  66.882389 192.168.1.199 ? 104.16.124.96 TLSv1.2 210 Client Hello (SNI=www.cloudflare.com)
3381  79.831790 192.168.1.199 ? 104.16.124.96 TLSv1.2 210 Client Hello (SNI=www.cloudflare.com)

Maybe I need to manually build lynx from the ports.
--