From 196ec09e559fbc4e801baf18b59524840d16fa1b Mon Sep 17 00:00:00 2001
From: xieyao <xieyao@xieyao.vip>
Date: Wed, 17 Jun 2026 15:19:54 +0800
Subject: [PATCH] fix: resolve P2P data plane decrypt failure and improve test
 environment

- Fix key derivation in both sdk/agent.go and internal/vl1/noise.go:
  sort public keys before hashing, use shared key for send/recv
- Adjust docker-compose port mappings to 7150-7153 range (within 7000-7200)
- Add GOPROXY env to Dockerfiles for Go module download in restricted networks
- Verified: all 3 clients connect with 2 peers each, zero decrypt errors
---
 Dockerfile.client     |  1 +
 Dockerfile.server     |  1 +
 docker-compose.yml    |  8 ++++----
 internal/vl1/noise.go | 24 ++++++++++--------------
 sdk/agent.go          | 18 +++++-------------
 5 files changed, 21 insertions(+), 31 deletions(-)

diff --git a/Dockerfile.client b/Dockerfile.client
index 7cd292a..69a7658 100644
--- a/Dockerfile.client
+++ b/Dockerfile.client
@@ -1,4 +1,5 @@
 FROM golang:1.26-alpine AS builder
+ENV GOPROXY=https://goproxy.cn,https://goproxy.io,direct
 WORKDIR /src
 COPY . .
 RUN go build -o /zmclient ./cmd/testclient/
diff --git a/Dockerfile.server b/Dockerfile.server
index 2ae2f12..ade8a20 100644
--- a/Dockerfile.server
+++ b/Dockerfile.server
@@ -1,4 +1,5 @@
 FROM golang:1.26-alpine AS builder
+ENV GOPROXY=https://goproxy.cn,https://goproxy.io,direct
 RUN apk add --no-cache gcc musl-dev
 WORKDIR /src
 COPY . .
diff --git a/docker-compose.yml b/docker-compose.yml
index 66b2038..a6ad141 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,7 +7,7 @@ services:
     hostname: server
     privileged: true
     ports:
-      - "7100:10001"
+      - "7150:10001"
     command:
       - sh
       - -c
@@ -67,7 +67,7 @@ services:
     hostname: client1
     privileged: true
     ports:
-      - "7201:7001/udp"
+      - "7151:7001/udp"
     depends_on:
       init:
         condition: service_completed_successfully
@@ -88,7 +88,7 @@ services:
     hostname: client2
     privileged: true
     ports:
-      - "7202:7002/udp"
+      - "7152:7002/udp"
     depends_on:
       init:
         condition: service_completed_successfully
@@ -109,7 +109,7 @@ services:
     hostname: client3
     privileged: true
     ports:
-      - "7203:7003/udp"
+      - "7153:7003/udp"
     depends_on:
       init:
         condition: service_completed_successfully
diff --git a/internal/vl1/noise.go b/internal/vl1/noise.go
index bc156eb..e6ad8d4 100644
--- a/internal/vl1/noise.go
+++ b/internal/vl1/noise.go
@@ -1,6 +1,7 @@
 package vl1
 
 import (
+	"bytes"
 	"crypto/cipher"
 	"crypto/rand"
 	"encoding/binary"
@@ -34,22 +35,17 @@ func NewNoiseCipher(sendKey, recvKey [32]byte) *NoiseCipher {
 }
 
 func DeriveKeysFromPSK(psk string, localPub, remotePub []byte) ([32]byte, [32]byte) {
+	first, second := localPub, remotePub
+	if bytes.Compare(localPub, remotePub) > 0 {
+		first, second = remotePub, localPub
+	}
 	h := sha3.New256()
 	h.Write([]byte(psk))
-	h.Write(localPub)
-	h.Write(remotePub)
-	sum := h.Sum(nil)
-
-	var sendKey, recvKey [32]byte
-	copy(sendKey[:], sum[:32])
-
-	h.Reset()
-	h.Write(sum)
-	h.Write([]byte("reverse"))
-	rev := h.Sum(nil)
-	copy(recvKey[:], rev[:32])
-
-	return sendKey, recvKey
+	h.Write(first)
+	h.Write(second)
+	var key [32]byte
+	copy(key[:], h.Sum(nil))
+	return key, key
 }
 
 func (nc *NoiseCipher) Encrypt(plaintext []byte) ([]byte, error) {
diff --git a/sdk/agent.go b/sdk/agent.go
index 3825855..3cb4856 100644
--- a/sdk/agent.go
+++ b/sdk/agent.go
@@ -636,25 +636,17 @@ func isBroadcastMAC(dst []byte) bool {
 }
 
 func deriveKeys(psk, localPub, remotePub []byte) ([32]byte, [32]byte) {
-	var first, second []byte
-	if bytes.Compare(localPub, remotePub) <= 0 {
-		first, second = localPub, remotePub
-	} else {
+	first, second := localPub, remotePub
+	if bytes.Compare(localPub, remotePub) > 0 {
 		first, second = remotePub, localPub
 	}
 	h := sha256.New()
 	h.Write(psk)
 	h.Write(first)
 	h.Write(second)
-	var sendKey [32]byte
-	copy(sendKey[:], h.Sum(nil))
-
-	h2 := sha256.New()
-	h2.Write(sendKey[:])
-	h2.Write([]byte("reverse"))
-	var recvKey [32]byte
-	copy(recvKey[:], h2.Sum(nil))
-	return sendKey, recvKey
+	var key [32]byte
+	copy(key[:], h.Sum(nil))
+	return key, key
 }