RTF_CLONING flag in the default route when VPN connection is active

Hey!

We are investigating a problem with routes when the VPN is active on macOS, and I wonder if this is expected behavior or a bug that should be registered.

I tested six different VPN providers on macOS 14.5 to ensure this problem does not only affect our product; I found out all VPN providers were affected.

When a user connects to the VPN and the app calls setTunnelNetworkSettings, the operating system creates a new default route in the system:

$ netstat -rn -f inet                                                                                                                              
Routing tables

Internet:
Destination        Gateway            Flags               Netif Expire
default            link#50            UCSg               utun23 <---- the new default route is added here
default            192.168.0.1        UGScIg               en10
...
...

A quick look into the netstat manual reveals the meaning of the flags for the route (UCSg)

• U - RTF_UP Route usable
• C - RTF_CLONING Generate new routes on use
• S - RTF_STATIC Manually added
• g - RTF_GLOBAL Route to a destination of the global internet (policy hint)

We are concerned about the C flag (RTF_CLONING) in particular. Let's experiment to show why we are interested in this flag. Upon connecting to the VPN, execute the following commands:

$ netstat -rn -f inet | grep 185.15.59.224
# empty output
$ ping wkipedia.org
PING wikipedia.org (185.15.59.224): 56 data bytes
64 bytes from 185.15.59.224: icmp_seq=0 ttl=58 time=38.798 ms
64 bytes from 185.15.59.224: icmp_seq=1 ttl=58 time=37.941 ms
^C

$ netstat -rn -f inet | grep 185.15.59.224
185.15.59.224      link#50            UHW3Ig             utun23     10

Notice the netstat command is executed without root privileges. A new route added (thanks to the RTF_CLONING flag) to the routing table means that the unprivileged user might easily track which websites were visited by another user, even if the latter uses a VPN service for the connection.

I spent some time experimenting but didn't find a way to call setTunnelNetworkSettings to add a default route without the RTF_CLONING flag.

Do you know if this is the expected behavior of the operating system, or should we register a bug for that behavior? Personally, I think it affects the user's rights to privacy quite heavily, especially because the netstat command might be executed by a regular user, does not need any priviliges to run.