Chute Devs

Hello everyone.

One of the most requested features from our users has been dynamic, remotely-updated rule sets. Today we are introducing Chute’s Rule-Set system, which brings Surge-compatible remote rule management to all Chute applications.

The Problem with Static Rules

Traditionally, proxy rules are defined inline in configuration files:

1
2
3
4
5

DOMAIN-SUFFIX,google.com,Proxy
DOMAIN-KEYWORD,facebook,Proxy
IP-CIDR,10.0.0.0/8,Direct
GEOIP,CN,Direct
FINAL,Proxy

This works well for a handful of rules, but modern proxy configurations often contain thousands of rules. A comprehensive China-whitelist ruleset, for example, can contain tens of thousands of domain entries. Embedding all these rules directly in the configuration file makes it unwieldy to edit, slow to load, and impossible to update independently.

How Rule-Set Works

A Rule-Set is a named collection of rules hosted at a URL. Instead of embedding rules directly, you reference the rule-set in your configuration:

1
2

RULE-SET,https://example.com/rulesets/apple.yaml,Proxy
RULE-SET,https://example.com/rulesets/china-whitelist.yaml,Direct

Chute downloads these rule-sets in the background, parses them, and applies them to traffic matching. The benefits:

• Independent updates: Rule-sets can be refreshed without touching your main configuration
• Sharing: Rule-sets can be shared across users and devices
• Size: Rule-sets can contain tens of thousands of entries without bloating your config file
• Specialization: Different rule-sets for different purposes — Apple services, China routing, ad blocking, etc.

The Architecture

Remote Download

Rule-sets are fetched over HTTP or HTTPS. We use a background download queue with configurable retry logic. If a download fails (network error, server unreachable), the previously cached version continues to be used — there is no interruption to service.

LRU Cache

Downloaded rule-sets are stored in an on-disk LRU (Least Recently Used) cache with a configurable maximum size. When the cache is full, the least recently accessed rule-set is evicted. Each rule-set has its own update-interval — you can configure how often Chute checks for updates, from every hour to once a week.

Rule Types Supported

Rule-sets support all the same rule types as inline rules:

The DOMAIN-SET Format

For very large domain lists, we introduced DOMAIN-SET — a compact binary format that uses a tree structure for efficient matching. A DOMAIN-SET with 50,000 entries occupies a fraction of the memory that individual DOMAIN-SUFFIX rules would use, and matching is orders of magnitude faster.

Rule Direction

Every rule in a rule-set can specify a direction: request (match when the connection is initiated), response (match based on the server’s response), or both. This is useful for rules that need to make decisions based on the TLS SNI or HTTP Host header.

Configuration Reload

When a rule-set update is downloaded, Chute can apply it without restarting the VPN tunnel. The rule engine reloads the affected rule-sets atomically — meaning connections in progress continue using the old rules until they complete, while new connections immediately pick up the updated rules. This ensures zero downtime during rule updates.

Performance

We rewrote the rule-matching engine to handle large rule-sets efficiently. The key optimizations:

1. Trie-based domain matching: Domain rules are indexed in a prefix tree for O(n) matching where n is the domain length, not the number of rules
2. CIDR tree for IP rules: IP rules use a binary tree for O(log n) matching
3. Result caching: Recently matched (domain, rule) pairs are cached in an LRU map to avoid repeated rule evaluation

On a typical configuration with 20,000 domain rules and 5,000 IP rules, rule matching adds less than 0.1ms of overhead per connection — imperceptible to users.

The Rule-Set system is a major step forward for Chute’s configuration management. It enables sharing, independent updates, and efficient handling of large rule collections. Whether you maintain your own rule-sets or subscribe to community-maintained ones, Chute now has the infrastructure to support them.

Thanks.

Chute Devs