lnpeer: add prefix to forwarding payment_keys.

This prevents collisions with payment_keys to an invoice of ours.

Note that this is not defense-in-depth: this commit does NOT
prevent a node from releasing the preimage, if it receives a
tiny trampoline HTLC to forward for one of its own invoices.
Indeed, the namespaced bucket would still enter the SETTLING
state.

What prevents the attack is the previous commit, and only that.

Author: ecdsa

electrum/lnpeer.py

@@ -48,7 +48,7 @@
                      IncompatibleLightningFeatures, ChannelType, LNProtocolWarning, validate_features,
                      IncompatibleOrInsaneFeatures, ReceivedMPPStatus, ReceivedMPPHtlc,
                      GossipForwardingMessage, GossipTimestampFilter, channel_id_from_funding_tx,
-                     serialize_htlc_key, Keypair, RecvMPPResolution)
+                     serialize_htlc_key, serialize_trampoline_fwd_key, Keypair, RecvMPPResolution)
 from .lntransport import LNTransport, LNTransportBase, LightningPeerConnectionClosed, HandshakeFailed
 from .lnmsg import encode_msg, decode_msg, UnknownOptionalMsgType, FailedToParseMsg
 from .interface import GracefulDisconnect
@@ -2222,7 +2222,7 @@ def _check_unfulfilled_htlc(
                 raise OnionRoutingFailure(code=OnionFailureCode.TEMPORARY_NODE_FAILURE, data=b'')
             if outer_onion_payment_secret:
                 # this is a trampoline forwarding htlc, multiple incoming trampoline htlcs can be collected
-                payment_key = (payment_hash + outer_onion_payment_secret).hex()
+                payment_key = serialize_trampoline_fwd_key(payment_hash, outer_onion_payment_secret)
                 return payment_key
             # this is a regular htlc to forward, it will get its own set of size 1 keyed by htlc_key
             # Additional checks required only for forwarding nodes will be done in maybe_forward_htlc().

electrum/lnutil.py

@@ -93,6 +93,11 @@ def deserialize_htlc_key(htlc_key: str) -> Tuple[bytes, int]:
     return bytes.fromhex(scid), int(htlc_id)
 
 
+def serialize_trampoline_fwd_key(payment_hash: bytes, outer_payment_secret: bytes) -> str:
+    """Bucket key for incoming htlcs we are asked to relay as a trampoline node. """
+    return 'fwd:' + (payment_hash + outer_payment_secret).hex()
+
+
 @attr.s
 class OnlyPubkeyKeypair(StoredObject):
     pubkey = attr.ib(type=bytes, converter=hex_to_bytes, repr=bytes_to_hex)

electrum/lnworker.py

@@ -2958,7 +2958,7 @@ def update_or_create_mpp_with_received_htlc(
     ):
         # Payment key creation:
         #   * for regular forwarded htlcs -> "scid.hex() + ':%d' % htlc_id" [htlc key]
-        #   * for trampoline forwarding -> "payment hash + payment secret from outer onion"
+        #   * for trampoline forwarding -> "fwd:" + (payment hash + payment secret from outer onion).hex()
         #   * for final non-trampoline htlcs (we are receiver) -> "payment hash + payment secret from onion"
         #   * for final trampoline htlcs (we are receiver) -> 2. step grouping:
         #           1. grouping of htlcs by "payments hash + outer onion payment secret", a 'multi-trampoline mpp part'.