> The problem for such products isn't reading SNI out of an HTTP/3 stream but successfully switching off matching streams. For TLS all they did is shut down the

> The problem for such products isn't reading SNI out of an HTTP/3 stream but successfully switching off matching streams. For TLS all they did is shut down the TCP connection on a match. But there is no connection for HTTP/3 because QUIC is a connectionless protocol. This is not true. QUIC is a Protocol that features a stateful connection. On top of that connection multiple streams are multiplexed. The SNI information is transmitted as part of the TLS ClientHello - which is transferred on connection establishment (before any streams and anything related to HTTP/3 exists). QUIC is running on top of a connectionless protocol (UDP) - but that doesn’t make it connectionless only itself. Same with TCP - it isn’t connectionless just because it runs on top of IP.