Print if lockdown mode is enabled when disconnected for `mullvad status`

Add `locked_down` field to disconnected tunnel state.

10 files changed, 69 insertions, 32 deletions

diff --git a/mullvad-cli/src/cmds/status.rs b/mullvad-cli/src/cmds/status.rs
index 15b0d10dfe..bb1fbe41fe 100644
--- a/mullvad-cli/src/cmds/status.rs
+++ b/mullvad-cli/src/cmds/status.rs
@@ -39,7 +39,10 @@ impl Status {
                         // match statement checks for duplicate tunnel states and skips the second
                         // print to avoid spamming the user.
                         match (&previous_tunnel_state, &new_state) {
-                            (Some(TunnelState::Disconnected(_)), TunnelState::Disconnected(_))
+                            (
+                                Some(TunnelState::Disconnected { .. }),
+                                TunnelState::Disconnected { .. },
+                            )
                             | (
                                 Some(TunnelState::Connected { .. }),
                                 TunnelState::Connected { .. },
@@ -91,7 +94,7 @@ pub async fn handle(cmd: Option<Status>, args: StatusArgs) -> Result<()> {
     let state = rpc.get_tunnel_state().await?;
     let device = rpc.get_device().await?;
 
-    print_account_loggedout(&state, &device);
+    print_account_logged_out(&state, &device);
 
     if args.debug {
         println!("Tunnel state: {state:#?}");
@@ -106,7 +109,7 @@ pub async fn handle(cmd: Option<Status>, args: StatusArgs) -> Result<()> {
     Ok(())
 }
 
-fn print_account_loggedout(state: &TunnelState, device: &DeviceState) {
+fn print_account_logged_out(state: &TunnelState, device: &DeviceState) {
     match state {
         TunnelState::Connecting { .. } | TunnelState::Connected { .. } | TunnelState::Error(_) => {
             match device {
@@ -117,6 +120,6 @@ fn print_account_loggedout(state: &TunnelState, device: &DeviceState) {
                 DeviceState::LoggedIn(_) => (),
             }
         }
-        TunnelState::Disconnected(_) | TunnelState::Disconnecting(_) => (),
+        TunnelState::Disconnected { .. } | TunnelState::Disconnecting(_) => (),
     }
 }
diff --git a/mullvad-cli/src/format.rs b/mullvad-cli/src/format.rs
index 512b632dc8..e605efbe3b 100644
--- a/mullvad-cli/src/format.rs
+++ b/mullvad-cli/src/format.rs
@@ -37,8 +37,15 @@ pub fn print_state(state: &TunnelState, verbose: bool) {
                 format_relay_connection(endpoint, location.as_ref(), verbose)
             );
         }
-        Disconnected(_) => {
-            println!("Disconnected");
+        Disconnected {
+            location: _,
+            locked_down,
+        } => {
+            if *locked_down {
+                println!("Disconnected (Internet access is blocked due to lockdown mode)");
+            } else {
+                println!("Disconnected");
+            }
         }
         Disconnecting(_) => println!("Disconnecting..."),
     }
@@ -46,7 +53,10 @@ pub fn print_state(state: &TunnelState, verbose: bool) {
 
 pub fn print_location(state: &TunnelState) {
     let location = match state {
-        TunnelState::Disconnected(location) => location,
+        TunnelState::Disconnected {
+            location,
+            locked_down: _,
+        } => location,
         TunnelState::Connected { location, .. } => location,
         _ => return,
     };
diff --git a/mullvad-daemon/src/lib.rs b/mullvad-daemon/src/lib.rs
index bb257ebc60..ed923c3ed1 100644
--- a/mullvad-daemon/src/lib.rs
+++ b/mullvad-daemon/src/lib.rs
@@ -439,7 +439,7 @@ impl DaemonExecutionState {
         match self {
             Running => {
                 match tunnel_state {
-                    TunnelState::Disconnected(_) => mem::replace(self, Finished),
+                    TunnelState::Disconnected { .. } => mem::replace(self, Finished),
                     _ => mem::replace(self, Exiting),
                 };
             }
@@ -856,7 +856,10 @@ where
         );
 
         let daemon = Daemon {
-            tunnel_state: TunnelState::Disconnected(None),
+            tunnel_state: TunnelState::Disconnected {
+                location: None,
+                locked_down: settings.block_when_disconnected,
+            },
             target_state,
             state: DaemonExecutionState::Running,
             #[cfg(target_os = "linux")]
@@ -999,7 +1002,11 @@ where
             .handle_state_transition(&tunnel_state_transition);
 
         let tunnel_state = match tunnel_state_transition {
-            TunnelStateTransition::Disconnected => TunnelState::Disconnected(None),
+            TunnelStateTransition::Disconnected => TunnelState::Disconnected {
+                location: None,
+                // If lockdown mode is enabled and state is disconnected
+                locked_down: self.settings.block_when_disconnected,
+            },
             TunnelStateTransition::Connecting(endpoint) => TunnelState::Connecting {
                 endpoint,
                 location: self.parameters_generator.get_last_location().await,
@@ -1024,7 +1031,7 @@ where
         log::debug!("New tunnel state: {:?}", tunnel_state);
 
         match tunnel_state {
-            TunnelState::Disconnected(_) => {
+            TunnelState::Disconnected { .. } => {
                 self.api_handle.availability.reset_inactivity_timer();
             }
             _ => {
@@ -1033,7 +1040,7 @@ where
         }
 
         match &tunnel_state {
-            TunnelState::Disconnected(_) => self.state.disconnected(),
+            TunnelState::Disconnected { .. } => self.state.disconnected(),
             TunnelState::Connecting { .. } => {
                 log::debug!("Settings: {}", self.settings.summary());
             }
@@ -1079,7 +1086,7 @@ where
             TunnelState::Connected { .. } => self.settings.tunnel_options.generic.enable_ipv6,
             // If not connected, we have to guess whether the users local connection supports IPv6.
             // The only thing we have to go on is the wireguard setting.
-            TunnelState::Disconnected(_) => {
+            TunnelState::Disconnected { .. } => {
                 if let RelaySettings::Normal(relay_constraints) = &self.settings.relay_settings {
                     // Note that `Constraint::Any` corresponds to just IPv4
                     matches!(
@@ -1098,7 +1105,7 @@ where
         self.location_handler.send_geo_location_request(use_ipv6);
     }
 
-    /// Recieves and handles the geographical exit location received from am.i.mullvad.net, i.e. the
+    /// Receives and handles the geographical exit location received from am.i.mullvad.net, i.e. the
     /// [`InternalDaemonEvent::LocationEvent`] event.
     fn handle_location_event(&mut self, location_data: LocationEventData) {
         let LocationEventData {
@@ -1112,7 +1119,10 @@ where
         }
 
         match self.tunnel_state {
-            TunnelState::Disconnected(ref mut location) => *location = Some(fetched_location),
+            TunnelState::Disconnected {
+                ref mut location,
+                locked_down: _,
+            } => *location = Some(fetched_location),
             TunnelState::Connected {
                 ref mut location, ..
             } => {
diff --git a/mullvad-management-interface/proto/management_interface.proto b/mullvad-management-interface/proto/management_interface.proto
index 5bf0c69f00..7087184a47 100644
--- a/mullvad-management-interface/proto/management_interface.proto
+++ b/mullvad-management-interface/proto/management_interface.proto
@@ -177,7 +177,10 @@ message ErrorState {
 }
 
 message TunnelState {
-  message Disconnected { GeoIpLocation disconnected_location = 1; }
+  message Disconnected {
+    GeoIpLocation disconnected_location = 1;
+    bool locked_down = 2;
+  }
   message Connecting { TunnelStateRelayInfo relay_info = 1; }
   message Connected { TunnelStateRelayInfo relay_info = 1; }
   message Disconnecting { AfterDisconnect after_disconnect = 1; }
diff --git a/mullvad-management-interface/src/types/conversions/states.rs b/mullvad-management-interface/src/types/conversions/states.rs
index 2541859e27..17329193c9 100644
--- a/mullvad-management-interface/src/types/conversions/states.rs
+++ b/mullvad-management-interface/src/types/conversions/states.rs
@@ -32,11 +32,13 @@ impl From<mullvad_types::states::TunnelState> for proto::TunnelState {
             };
 
         let state = match state {
-            MullvadTunnelState::Disconnected(disconnected_location) => {
-                proto::tunnel_state::State::Disconnected(proto::tunnel_state::Disconnected {
-                    disconnected_location: disconnected_location.map(proto::GeoIpLocation::from),
-                })
-            }
+            MullvadTunnelState::Disconnected {
+                location: disconnected_location,
+                locked_down,
+            } => proto::tunnel_state::State::Disconnected(proto::tunnel_state::Disconnected {
+                disconnected_location: disconnected_location.map(proto::GeoIpLocation::from),
+                locked_down,
+            }),
             MullvadTunnelState::Connecting { endpoint, location } => {
                 proto::tunnel_state::State::Connecting(proto::tunnel_state::Connecting {
                     relay_info: Some(proto::TunnelStateRelayInfo {
@@ -193,11 +195,13 @@ impl TryFrom<proto::TunnelState> for mullvad_types::states::TunnelState {
         let state = match state.state {
             Some(proto::tunnel_state::State::Disconnected(proto::tunnel_state::Disconnected {
                 disconnected_location,
-            })) => MullvadState::Disconnected(
-                disconnected_location
+                locked_down,
+            })) => MullvadState::Disconnected {
+                location: disconnected_location
                     .map(mullvad_types::location::GeoIpLocation::try_from)
                     .transpose()?,
-            ),
+                locked_down,
+            },
             Some(proto::tunnel_state::State::Connecting(proto::tunnel_state::Connecting {
                 relay_info:
                     Some(proto::TunnelStateRelayInfo {
diff --git a/mullvad-types/src/states.rs b/mullvad-types/src/states.rs
index 4a266d1d6e..67f95b23e1 100644
--- a/mullvad-types/src/states.rs
+++ b/mullvad-types/src/states.rs
@@ -34,7 +34,11 @@ impl fmt::Display for TargetState {
 #[cfg_attr(target_os = "android", derive(IntoJava))]
 #[cfg_attr(target_os = "android", jnix(package = "net.mullvad.mullvadvpn.model"))]
 pub enum TunnelState {
-    Disconnected(Option<GeoIpLocation>),
+    Disconnected {
+        location: Option<GeoIpLocation>,
+        /// Whether internet access is blocked due to lockdown mode
+        locked_down: bool,
+    },
     Connecting {
         endpoint: TunnelEndpoint,
         location: Option<GeoIpLocation>,
@@ -60,6 +64,6 @@ impl TunnelState {
 
     /// Returns true if the tunnel state is in the disconnected state.
     pub fn is_disconnected(&self) -> bool {
-        matches!(self, TunnelState::Disconnected(_))
+        matches!(self, TunnelState::Disconnected { .. })
     }
 }
diff --git a/talpid-types/src/tunnel.rs b/talpid-types/src/tunnel.rs
index 3d34f4a96a..c035206a1d 100644
--- a/talpid-types/src/tunnel.rs
+++ b/talpid-types/src/tunnel.rs
@@ -11,7 +11,10 @@ use std::net::IpAddr;
 #[derive(Clone, Debug)]
 pub enum TunnelStateTransition {
     /// No connection is established and network is unsecured.
-    Disconnected,
+    Disconnected {
+        /// Whether internet access is blocked due to lockdown mode
+        locked_down: bool,
+    },
     /// Network is secured but tunnel is still connecting.
     Connecting(TunnelEndpoint),
     /// Tunnel is connected.
diff --git a/test/test-manager/src/tests/helpers.rs b/test/test-manager/src/tests/helpers.rs
index 3956aa2c15..9f092f60f2 100644
--- a/test/test-manager/src/tests/helpers.rs
+++ b/test/test-manager/src/tests/helpers.rs
@@ -227,7 +227,7 @@ pub async fn disconnect_and_wait(mullvad_client: &mut MullvadProxyClient) -> Res
         .await
         .map_err(|error| Error::Daemon(format!("failed to begin disconnecting: {}", error)))?;
     wait_for_tunnel_state(mullvad_client.clone(), |state| {
-        matches!(state, TunnelState::Disconnected(_))
+        matches!(state, TunnelState::Disconnected { .. })
     })
     .await?;
 
diff --git a/test/test-manager/src/tests/settings.rs b/test/test-manager/src/tests/settings.rs
index 5fdd298de1..2b488dea22 100644
--- a/test/test-manager/src/tests/settings.rs
+++ b/test/test-manager/src/tests/settings.rs
@@ -107,7 +107,7 @@ pub async fn test_lockdown(
     let inet_destination: SocketAddr = "1.1.1.1:1337".parse().unwrap();
 
     log::info!("Verify tunnel state: disconnected");
-    assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected(_));
+    assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected { .. });
 
     // Enable lockdown mode
     //
diff --git a/test/test-manager/src/tests/tunnel_state.rs b/test/test-manager/src/tests/tunnel_state.rs
index 5b884474ac..7abc505939 100644
--- a/test/test-manager/src/tests/tunnel_state.rs
+++ b/test/test-manager/src/tests/tunnel_state.rs
@@ -32,7 +32,7 @@ pub async fn test_disconnected_state(
     let inet_destination = "1.3.3.7:1337".parse().unwrap();
 
     log::info!("Verify tunnel state: disconnected");
-    assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected(_));
+    assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected { .. });
 
     // Test whether outgoing packets can be observed
     //
@@ -89,7 +89,7 @@ pub async fn test_connecting_state(
     let lan_dns: SocketAddr = SocketAddr::new(IpAddr::V4(DUMMY_LAN_INTERFACE_IP), 53);
 
     log::info!("Verify tunnel state: disconnected");
-    assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected(_));
+    assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected { .. });
 
     let relay_settings = RelaySettings::CustomTunnelEndpoint(CustomTunnelEndpoint {
         host: "1.3.3.7".to_owned(),
@@ -171,7 +171,7 @@ pub async fn test_error_state(
     let lan_dns: SocketAddr = SocketAddr::new(IpAddr::V4(DUMMY_LAN_INTERFACE_IP), 53);
 
     log::info!("Verify tunnel state: disconnected");
-    assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected(_));
+    assert_tunnel_state!(&mut mullvad_client, TunnelState::Disconnected { .. });
 
     // Connect to non-existent location
     //