From 4c735bc5587aeb954b259225580036a2ddc5bd6a Mon Sep 17 00:00:00 2001
From: Quentin McGaw <quentin.mcgaw@gmail.com>
Date: Tue, 19 May 2026 15:18:37 +0000
Subject: [PATCH] PR review feedback

---
 Dockerfile                  | 2 +-
 cmd/gluetun/main.go         | 1 +
 internal/socks5/response.go | 4 ++--
 internal/socks5/socks5.go   | 5 ++++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index bd2e976a..afe91c7f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -276,7 +276,7 @@ ENV VPN_SERVICE_PROVIDER=pia \
     PUID=1000 \
     PGID=1000
 ENTRYPOINT ["/gluetun-entrypoint"]
-EXPOSE 8000/tcp 8888/tcp 8388/tcp 8388/udp
+EXPOSE 8000/tcp 8888/tcp 8388/tcp 8388/udp 1080/tcp
 HEALTHCHECK --interval=5s --timeout=5s --start-period=10s --retries=3 CMD /gluetun-entrypoint healthcheck
 ARG TARGETPLATFORM
 RUN apk add --no-cache --update -l wget && \
diff --git a/cmd/gluetun/main.go b/cmd/gluetun/main.go
index ebbf92da..bc3c3447 100644
--- a/cmd/gluetun/main.go
+++ b/cmd/gluetun/main.go
@@ -413,6 +413,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 	}
 
 	socks5Loop := socks5.NewLoop(socks5.Settings{
+		Enabled:  *allSettings.Socks5.Enabled,
 		Username: *allSettings.Socks5.Username,
 		Password: *allSettings.Socks5.Password,
 		Address:  allSettings.Socks5.ListeningAddress,
diff --git a/internal/socks5/response.go b/internal/socks5/response.go
index 4df7ebee..b65ee5e9 100644
--- a/internal/socks5/response.go
+++ b/internal/socks5/response.go
@@ -33,7 +33,7 @@ func (c *socksConn) encodeSuccessResponse(writer io.Writer, socksVersion byte,
 ) (err error) {
 	bindData, err := encodeBindData(bindAddrType, bindAddress, bindPort)
 	if err != nil {
-		return err
+		return fmt.Errorf("encoding bind data: %w", err)
 	}
 
 	const initialPacketLength = 3
@@ -46,7 +46,7 @@ func (c *socksConn) encodeSuccessResponse(writer io.Writer, socksVersion byte,
 
 	_, err = writer.Write(packet)
 	if err != nil {
-		c.logger.Warnf("failed writing success response: %s", err)
+		return fmt.Errorf("writing packet: %w", err)
 	}
 	return nil
 }
diff --git a/internal/socks5/socks5.go b/internal/socks5/socks5.go
index a92a778a..73449da1 100644
--- a/internal/socks5/socks5.go
+++ b/internal/socks5/socks5.go
@@ -218,9 +218,12 @@ func decodeRequest(reader io.Reader, expectedVersion byte) (req request, err err
 	}
 
 	version := header[0]
-	if header[0] != expectedVersion {
+	switch {
+	case version != expectedVersion:
 		return request{}, fmt.Errorf("version is not supported: expected %d and got %d",
 			expectedVersion, version)
+	case header[2] != 0:
+		return request{}, fmt.Errorf("reserved header byte must be 0 but got %d", header[2])
 	}
 
 	req.command = cmdType(header[1])