From 1d460731bd7ac45df34f158cf02536934a733225 Mon Sep 17 00:00:00 2001
From: Claire Wang <claire@tailscale.com>
Date: Wed, 27 Mar 2024 16:59:20 -0400
Subject: [PATCH] wip

---
 ipn/ipnlocal/local.go | 12 ++++++++++++
 ipn/prefs.go          |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 5e0f2a58b..5fcb73a8d 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -1142,6 +1142,9 @@ func (b *LocalBackend) SetControlClientStatus(c controlclient.Client, st control
 	if setExitNodeID(prefs, st.NetMap) {
 		prefsChanged = true
 	}
+	if setExitNodeDstLogging(prefs) {
+		prefsChanged = true
+	}
 	if applySysPolicy(prefs) {
 		prefsChanged = true
 	}
@@ -1327,6 +1330,14 @@ func applySysPolicy(prefs *ipn.Prefs) (anyChange bool) {
 	return anyChange
 }
 
+func setExitNodeDstLogging(prefs *ipn.Prefs) (anyChange bool) {
+	if enable, err := syspolicy.GetBoolean(syspolicy.ExitDestinationFlowLogs, prefs.ExitDestinationFlowLog); err == nil && prefs.ExitDestinationFlowLog != enable {
+		prefs.ExitDestinationFlowLog = enable
+		anyChange = true
+	}
+	return anyChange
+}
+
 var _ controlclient.NetmapDeltaUpdater = (*LocalBackend)(nil)
 
 // UpdateNetmapDelta implements controlclient.NetmapDeltaUpdater.
@@ -3239,6 +3250,7 @@ func (b *LocalBackend) setPrefsLockedOnEntry(caller string, newp *ipn.Prefs) ipn
 	// everything in this function treats b.prefs as completely new
 	// anyway. No-op if no exit node resolution is needed.
 	setExitNodeID(newp, netMap)
+	setExitNodeDstLogging(newp)
 	// applySysPolicy does likewise so we can also ignore its return value.
 	applySysPolicy(newp)
 	// We do this to avoid holding the lock while doing everything else.
diff --git a/ipn/prefs.go b/ipn/prefs.go
index 0055b7fb2..0819663b8 100644
--- a/ipn/prefs.go
+++ b/ipn/prefs.go
@@ -109,6 +109,8 @@ type Prefs struct {
 	// routed directly or via the exit node.
 	ExitNodeAllowLANAccess bool
 
+	ExitDestinationFlowLog bool
+
 	// CorpDNS specifies whether to install the Tailscale network's
 	// DNS configuration, if it exists.
 	CorpDNS bool