Reinit keys at the start of options_act().

Previously we did this nearer to the end (in the old_options &&
transition_affects_workers() block).  But other stuff cares about
keys being consistent with options... particularly anything which
tries to access a key, which can die in assert_identity_keys_ok().

Fixes bug 3228; bugfix on 0.2.2.18-alpha.

1 files changed, 15 insertions, 8 deletions

diff --git a/src/or/config.c b/src/or/config.c
index 46b0cef413..117925549e 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -1172,12 +1172,26 @@ options_act(or_options_t *old_options)
   or_options_t *options = get_options();
   int running_tor = options->command == CMD_RUN_TOR;
   char *msg;
+  const int transition_affects_workers =
+    old_options && options_transition_affects_workers(old_options, options);
 
   if (running_tor && !have_lockfile()) {
     if (try_locking(options, 1) < 0)
       return -1;
   }
 
+  /* We want to reinit keys as needed before we do much of anything else:
+     keys are important, and other things can depend on them. */
+  if (running_tor &&
+      (transition_affects_workers ||
+       (options->V3AuthoritativeDir && (!old_options ||
+                                        !old_options->V3AuthoritativeDir)))) {
+    if (init_keys() < 0) {
+      log_warn(LD_BUG,"Error initializing keys; exiting");
+      return -1;
+    }
+  }
+
   if (consider_adding_dir_authorities(options, old_options) < 0)
     return -1;
 
@@ -1346,14 +1360,10 @@ options_act(or_options_t *old_options)
       }
     }
 
-    if (options_transition_affects_workers(old_options, options)) {
+    if (transition_affects_workers) {
       log_info(LD_GENERAL,
                "Worker-related options changed. Rotating workers.");
 
-      if (init_keys() < 0) {
-        log_warn(LD_BUG,"Error initializing keys; exiting");
-        return -1;
-      }
       if (server_mode(options) && !server_mode(old_options)) {
         ip_address_changed(0);
         if (can_complete_circuit || !any_predicted_circuits(time(NULL)))
@@ -1367,9 +1377,6 @@ options_act(or_options_t *old_options)
         return -1;
     }
 
-    if (options->V3AuthoritativeDir && !old_options->V3AuthoritativeDir)
-      init_keys();
-
     if (options->PerConnBWRate != old_options->PerConnBWRate ||
         options->PerConnBWBurst != old_options->PerConnBWBurst)
       connection_or_update_token_buckets(get_connection_array(), options);