sphinx: Use the new `fromwire_tlv_payload` function

We wire in the code-generated function, which removes the upfront validation
and add the validation back after the `htlc_accepted` hook returns. If a
plugin wanted to handle the onion in a special way it'll not have told us to
just continue.

common/sphinx.c

@@ -591,9 +591,13 @@ static void sphinx_parse_payload(struct route_step *step, const u8 *src)
 		const u8 *tlv = step->raw_payload;
 		size_t max = tal_bytelen(tlv);
 		step->payload.tlv = tlv_tlv_payload_new(step);
-		if (!fromwire_tlvs(&tlv, &max, tlvs_tlv_payload,
+
-				   TLVS_TLV_PAYLOAD_ARRAY_SIZE,
+		/* The raw payload includes the length / realm prefix, Consume
-				   step->payload.tlv)) {
+		 * the length off of the payload, so the decoding can strat
+		 * correctly. */
+		fromwire_varint(&tlv, &max);
+
+		if (!fromwire_tlv_payload(&tlv, &max, step->payload.tlv)) {
 			/* FIXME: record offset of violation for error! */
 			step->type = SPHINX_INVALID_PAYLOAD;
 			return;

common/test/run-sphinx.c

@@ -56,12 +56,6 @@ void fromwire_sha256(const u8 **cursor UNNEEDED, size_t *max UNNEEDED, struct sh
 void fromwire_short_channel_id(const u8 **cursor UNNEEDED, size_t *max UNNEEDED,
 			       struct short_channel_id *short_channel_id UNNEEDED)
 { fprintf(stderr, "fromwire_short_channel_id called!\n"); abort(); }
-/* Generated stub for fromwire_tlvs */
-bool fromwire_tlvs(const u8 **cursor UNNEEDED, size_t *max UNNEEDED,
-		   const struct tlv_record_type types[] UNNEEDED,
-		   size_t num_types UNNEEDED,
-		   void *record UNNEEDED)
-{ fprintf(stderr, "fromwire_tlvs called!\n"); abort(); }
 /* Generated stub for fromwire_tu32 */
 u32 fromwire_tu32(const u8 **cursor UNNEEDED, size_t *max UNNEEDED)
 { fprintf(stderr, "fromwire_tu32 called!\n"); abort(); }

lightningd/peer_htlcs.c

@@ -781,7 +781,11 @@ htlc_accepted_hook_callback(struct htlc_accepted_hook_payload *request,
 
 	switch (result) {
 	case htlc_accepted_continue:
-		if (rs->nextcase == ONION_FORWARD) {
+		if (rs->type == SPHINX_TLV_PAYLOAD && !tlv_payload_is_valid(rs->payload.tlv)) {
+			log_debug(channel->log, "Failing HTLC because of an invalid TLV payload");
+			failure_code = WIRE_INVALID_ONION_PAYLOAD;
+			fail_in_htlc(hin, failure_code, NULL, request->short_channel_id);
+		}else if (rs->nextcase == ONION_FORWARD) {
 			struct gossip_resolve *gr = tal(ld, struct gossip_resolve);
 
 			gr->next_onion = serialize_onionpacket(gr, rs->next);