fix: resolve P2P data plane decrypt failure and improve test environment

- Fix key derivation in both sdk/agent.go and internal/vl1/noise.go:
  sort public keys before hashing, use shared key for send/recv
- Adjust docker-compose port mappings to 7150-7153 range (within 7000-7200)
- Add GOPROXY env to Dockerfiles for Go module download in restricted networks
- Verified: all 3 clients connect with 2 peers each, zero decrypt errors

Dockerfile.client

@@ -1,4 +1,5 @@
 FROM golang:1.26-alpine AS builder
+ENV GOPROXY=https://goproxy.cn,https://goproxy.io,direct
 WORKDIR /src
 COPY . .
 RUN go build -o /zmclient ./cmd/testclient/

Dockerfile.server

@@ -1,4 +1,5 @@
 FROM golang:1.26-alpine AS builder
+ENV GOPROXY=https://goproxy.cn,https://goproxy.io,direct
 RUN apk add --no-cache gcc musl-dev
 WORKDIR /src
 COPY . .

docker-compose.yml

@@ -7,7 +7,7 @@ services:
     hostname: server
     privileged: true
     ports:
-      - "7100:10001"
+      - "7150:10001"
     command:
       - sh
       - -c
@@ -67,7 +67,7 @@ services:
     hostname: client1
     privileged: true
     ports:
-      - "7201:7001/udp"
+      - "7151:7001/udp"
     depends_on:
       init:
         condition: service_completed_successfully
@@ -88,7 +88,7 @@ services:
     hostname: client2
     privileged: true
     ports:
-      - "7202:7002/udp"
+      - "7152:7002/udp"
     depends_on:
       init:
         condition: service_completed_successfully
@@ -109,7 +109,7 @@ services:
     hostname: client3
     privileged: true
     ports:
-      - "7203:7003/udp"
+      - "7153:7003/udp"
     depends_on:
       init:
         condition: service_completed_successfully

internal/vl1/noise.go

@@ -1,6 +1,7 @@
 package vl1
 
 import (
+	"bytes"
 	"crypto/cipher"
 	"crypto/rand"
 	"encoding/binary"
@@ -34,22 +35,17 @@ func NewNoiseCipher(sendKey, recvKey [32]byte) *NoiseCipher {
 }
 
 func DeriveKeysFromPSK(psk string, localPub, remotePub []byte) ([32]byte, [32]byte) {
+	first, second := localPub, remotePub
+	if bytes.Compare(localPub, remotePub) > 0 {
+		first, second = remotePub, localPub
+	}
 	h := sha3.New256()
 	h.Write([]byte(psk))
-	h.Write(localPub)
+	h.Write(first)
-	h.Write(remotePub)
+	h.Write(second)
-	sum := h.Sum(nil)
+	var key [32]byte
-
+	copy(key[:], h.Sum(nil))
-	var sendKey, recvKey [32]byte
+	return key, key
-	copy(sendKey[:], sum[:32])
-
-	h.Reset()
-	h.Write(sum)
-	h.Write([]byte("reverse"))
-	rev := h.Sum(nil)
-	copy(recvKey[:], rev[:32])
-
-	return sendKey, recvKey
 }
 
 func (nc *NoiseCipher) Encrypt(plaintext []byte) ([]byte, error) {

sdk/agent.go

@@ -636,25 +636,17 @@ func isBroadcastMAC(dst []byte) bool {
 }
 
 func deriveKeys(psk, localPub, remotePub []byte) ([32]byte, [32]byte) {
-	var first, second []byte
+	first, second := localPub, remotePub
-	if bytes.Compare(localPub, remotePub) <= 0 {
+	if bytes.Compare(localPub, remotePub) > 0 {
-		first, second = localPub, remotePub
-	} else {
 		first, second = remotePub, localPub
 	}
 	h := sha256.New()
 	h.Write(psk)
 	h.Write(first)
 	h.Write(second)
-	var sendKey [32]byte
+	var key [32]byte
-	copy(sendKey[:], h.Sum(nil))
+	copy(key[:], h.Sum(nil))
-
+	return key, key
-	h2 := sha256.New()
-	h2.Write(sendKey[:])
-	h2.Write([]byte("reverse"))
-	var recvKey [32]byte
-	copy(recvKey[:], h2.Sum(nil))
-	return sendKey, recvKey
 }