Enter or leave error state when account runs out of time or has time

added

2 files changed, 26 insertions, 2 deletions

diff --git a/mullvad-daemon/src/device/mod.rs b/mullvad-daemon/src/device/mod.rs
index a27b3eb439..06d9a9b898 100644
--- a/mullvad-daemon/src/device/mod.rs
+++ b/mullvad-daemon/src/device/mod.rs
@@ -1066,10 +1066,12 @@ impl TunnelStateChangeHandler {
                         if !check_validity.swap(false, Ordering::SeqCst) {
                             return;
                         }
-                        if let Err(error) = handle.validate_device().await {
+                        if let Err(error) = Self::check_validity(handle).await {
                             log::error!(
                                 "{}",
-                                error.display_chain_with_msg("Failed to check device validity")
+                                error.display_chain_with_msg(
+                                    "Failed to check device or account validity"
+                                )
                             );
                             if error.is_network_error() || error.is_aborted() {
                                 check_validity.store(true, Ordering::SeqCst);
@@ -1087,4 +1089,9 @@ impl TunnelStateChangeHandler {
             _ => (),
         }
     }
+
+    pub async fn check_validity(handle: AccountManagerHandle) -> Result<(), Error> {
+        handle.validate_device().await?;
+        handle.check_expiry().await.map(|_expiry| ())
+    }
 }
diff --git a/mullvad-daemon/src/lib.rs b/mullvad-daemon/src/lib.rs
index 287584e85b..4d65e3dc57 100644
--- a/mullvad-daemon/src/lib.rs
+++ b/mullvad-daemon/src/lib.rs
@@ -1069,6 +1069,23 @@ where
                     self.schedule_reconnect(WG_RECONNECT_DELAY);
                 }
             }
+            PrivateDeviceEvent::AccountExpiry(expiry)
+                if *self.target_state == TargetState::Secured =>
+            {
+                if expiry >= &chrono::Utc::now() {
+                    if let TunnelState::Error(ref state) = self.tunnel_state {
+                        if matches!(state.cause(), ErrorStateCause::AuthFailed(_)) {
+                            log::debug!("Reconnecting since the account has time on it");
+                            self.connect_tunnel();
+                        }
+                    }
+                } else if self.get_target_tunnel_type() == Some(TunnelType::Wireguard) {
+                    log::debug!("Entering blocking state since the account is out of time");
+                    self.send_tunnel_command(TunnelCommand::Block(ErrorStateCause::AuthFailed(
+                        None,
+                    )))
+                }
+            }
             _ => (),
         }
         if let Ok(event) = DeviceEvent::try_from(event) {