code: func clientHelloServerName(br *bufio.Reader) (string, bool, string) {
  	hdr, err := br.Peek(1)
  	if err != nil {
  		if err != io.EOF {
  			log.Errorf("Error while Peeking first byte: %s", err)
  		}
  		return "", false, ""
  	}
  	const recordTypeHandshake = 0x16
  	if hdr[0] != recordTypeHandshake {
  		// log.Errorf("Error not tls")
  		return "", false, getPeeked(br) // Not TLS.
  	}
  
  	const recordHeaderLen = 5
  	hdr, err = br.Peek(recordHeaderLen)
  	if err != nil {
  		log.Errorf("Error while Peeking hello: %s", err)
  		return "", false, getPeeked(br)
  	}
  	recLen := int(hdr[3])<<8 | int(hdr[4]) // ignoring version in hdr[1:3]
  	helloBytes, err := br.Peek(recordHeaderLen + recLen)
  	if err != nil {
  		log.Errorf("Error while Hello: %s", err)
  		return "", true, getPeeked(br)
  	}
  	sni := ""
  	server := tls.Server(sniSniffConn{r: bytes.NewReader(helloBytes)}, &tls.Config{
  		GetConfigForClient: func(hello *tls.ClientHelloInfo) (*tls.Config, error) {
  			sni = hello.ServerName
  			return nil, nil
  		},
  	})
  	_ = server.Handshake()
  	return sni, true, getPeeked(br)
  }
docs: // clientHelloServerName returns the SNI server name inside the TLS ClientHello,
  // without consuming any bytes from br.
  // On any error, the empty string is returned.