lnwire: reject onion message payloads with unknown even types

diff --git a/lnwire/onion_msg_payload.go b/lnwire/onion_msg_payload.go
index 7b384d9..63bd546 100644
--- a/lnwire/onion_msg_payload.go
+++ b/lnwire/onion_msg_payload.go
@@ -39,6 +39,12 @@ const (
 // correct range.
 var ErrNotFinalPayload = errors.New("final hop payloads type should be >= 64")
 
+// ErrUnknownEvenType is returned when an onion message payload contains an
+// unknown even TLV type. BOLT 4 requires the whole message to be ignored in
+// this case, because even types are "must understand".
+var ErrUnknownEvenType = errors.New("onion message payload contains unknown " +
+	"even tlv type")
+
 // OnionMessagePayload contains the contents of an onion message payload.
 type OnionMessagePayload struct {
 	// ReplyPath contains a blinded path that can be used to respond to an
@@ -174,11 +180,6 @@ func (o *OnionMessagePayload) Decode(r io.Reader) (map[tlv.Type][]byte, error) {
 	// recognized. We'll just directly read these out and allow higher
 	// application layers to deal with them.
 	for tlvType, tlvBytes := range tlvMap {
-		// Skip any tlvs that are not in our range.
-		if tlvType < finalHopPayloadStart {
-			continue
-		}
-
 		// Skip any tlvs that have been recognized in our decoding.
 		// DecodeWithParsedTypesP2P stores a nil entry for known types
 		// that it decoded into a dedicated field above, and the raw
@@ -189,7 +190,25 @@ func (o *OnionMessagePayload) Decode(r io.Reader) (map[tlv.Type][]byte, error) {
 			continue
 		}
 
-		// Add the payload to our message's final hop payloads.
+		// BOLT 4: if the onionmsg_tlv contains unknown even types, the
+		// whole message must be ignored, since even types are
+		// "must understand". This applies regardless of the type range,
+		// so we check it before skipping types outside the final hop
+		// range.
+		if tlvType%2 == 0 {
+			return tlvMap, fmt.Errorf("%w: %v", ErrUnknownEvenType,
+				tlvType)
+		}
+
+		// Skip any unknown odd tlvs outside the final hop payload
+		// range: they are not addressed to the final hop's application
+		// layer, and odd types are safe to ignore.
+		if tlvType < finalHopPayloadStart {
+			continue
+		}
+
+		// Add the unknown odd final hop payload to our message so that
+		// higher application layers can deal with it.
 		payload := &FinalHopTLV{
 			TLVType: tlvType,
 			Value:   tlvBytes,
diff --git a/lnwire/onion_msg_payload_test.go b/lnwire/onion_msg_payload_test.go
index 4cc464d..36affb5 100644
--- a/lnwire/onion_msg_payload_test.go
+++ b/lnwire/onion_msg_payload_test.go
@@ -316,6 +316,49 @@ func TestOnionMessagePayloadRoundTrip(t *testing.T) {
 		require.Equal(t, tlv.Type(65), decoded.FinalHopTLVs[0].TLVType)
 		require.Empty(t, decoded.FinalHopTLVs[0].Value)
 	})
+
+	t.Run("unknown even final hop type rejected", func(t *testing.T) {
+		t.Parallel()
+
+		// Type 70 is in the final hop range but is an unknown even
+		// type, so BOLT 4 requires the message to be ignored.
+		original := &OnionMessagePayload{
+			FinalHopTLVs: []*FinalHopTLV{
+				{
+					TLVType: 70,
+					Value:   []byte("must-understand"),
+				},
+			},
+		}
+
+		encoded, err := original.Encode()
+		require.NoError(t, err)
+
+		decoded := NewOnionMessagePayload()
+		_, err = decoded.Decode(bytes.NewReader(encoded))
+		require.ErrorIs(t, err, ErrUnknownEvenType)
+	})
+
+	t.Run("unknown even type below range rejected", func(t *testing.T) {
+		t.Parallel()
+
+		// An unknown even type outside the final hop range must also be
+		// rejected: the must-understand rule applies regardless of the
+		// tlv range. We build the stream directly because the encoder's
+		// FinalHopTLV.Validate would reject a sub-64 type.
+		val := []byte("data")
+		record := tlv.MakePrimitiveRecord(tlv.Type(6), &val)
+
+		stream, err := tlv.NewStream(record)
+		require.NoError(t, err)
+
+		var b bytes.Buffer
+		require.NoError(t, stream.Encode(&b))
+
+		decoded := NewOnionMessagePayload()
+		_, err = decoded.Decode(bytes.NewReader(b.Bytes()))
+		require.ErrorIs(t, err, ErrUnknownEvenType)
+	})
 }
 
 // TestFinalHopTLVValidate tests that FinalHopTLV.Validate correctly rejects