htlcswitch+routing: implement expiry_too_far failure

In this commit we add a check to HtlcSatifiesPolicy to verify that the
time lock for the outgoing htlc that is requested in the onion packet
isn't too far in the future.

Without this check, anyone could force an unreasonably long time lock on
the forwarding node.

htlcswitch/link.go

@@ -36,6 +36,17 @@ const (
 	// TODO(roasbeef): must be < default delta
 	expiryGraceDelta = 2
 
+	// maxCltvExpiry is the maximum outgoing time lock that the node accepts
+	// for forwarded payments. The value is relative to the current block
+	// height. The reason to have a maximum is to prevent funds getting
+	// locked up unreasonably long. Otherwise, an attacker willing to lock
+	// its own funds too, could force the funds of this node to be locked up
+	// for an indefinite (max int32) number of blocks.
+	//
+	// The value 5000 is based on the maximum number of hops (20), the
+	// default cltv delta (144) and some extra margin.
+	maxCltvExpiry = 5000
+
 	// DefaultMinLinkFeeUpdateTimeout represents the minimum interval in
 	// which a link should propose to update its commitment fee rate.
 	DefaultMinLinkFeeUpdateTimeout = 10 * time.Minute
@@ -1950,6 +1961,14 @@ func (l *channelLink) HtlcSatifiesPolicy(payHash [32]byte,
 		return failure
 	}
 
+	if outgoingTimeout-heightNow > maxCltvExpiry {
+		l.errorf("outgoing htlc(%x) has a time lock too far in the "+
+			"future: got %v, but maximum is %v", payHash[:],
+			outgoingTimeout-heightNow, maxCltvExpiry)
+
+		return &lnwire.FailExpiryTooFar{}
+	}
+
 	// Finally, we'll ensure that the time-lock on the outgoing HTLC meets
 	// the following constraint: the incoming time-lock minus our time-lock
 	// delta should equal the outgoing time lock. Otherwise, whether the