Sniff() calls Peek(5) which blocks on SOCKS5 greeting (3 bytes:
VER, NMETHODS, METHODS). The SOCKS5 connector sends those 3 bytes
and then waits for the server's method-selection reply — deadlock.
Restore the original 1-byte peek for SOCKS4 (0x04) / SOCKS5 (0x05)
detection first, routing them to their handlers immediately. Only
call Sniff() for non-SOCKS traffic (TLS, HTTP, SSH) where 5 bytes
are guaranteed.
Fixesgo-gost/gost#879
ginuerzh
c1d954d689