Skip to main content
CLI man page: safesquid-contentSignatures(5)
The Content Signatures section (safesquid-contentSignatures(5)) maintains the content-signature database and libmagic MIME detection used across SafeSquid. It helps identify actual file types, bypassing deceptive file extensions — but live connection tagging for policy uses Response Types in the current build.
Custom rows are merged into content4.xml under /var/lib/safesquid/content_signatures/. Tag names still appear in DLP and UI pickers even when the request-time hooks are inactive.

​
Core mechanics

​
What runs at runtime today

  1. On config load and on scheduled update, SafeSquid may download vendor content4.xml and reload the merged database.
  2. Custom rows from the Web UI are saved to the dev copy of content4.xml when the section is displayable.
  3. The internal MIME engine uses the libmagic database from this directory for body type detection (also used by DLP, logging, and Response Types).
  4. The request-time hooks are not implemented — list rows do not add or remove connection tags at request time in the current build.
For live response labelling by MIME or extension, use Response Types. Content Signatures rows still matter for database maintenance, autocomplete in other sections (for example DLP), and libmagic setup.

​
Global Enabled

When off, the section reports itself disabled — signature database download/reload and MIME library setup are affected. List rows are still persisted even when the request-time hooks are inactive.

​
Subsections

  • Content Signatures List — MIME regex rows plus tags to add. Stored in config; not applied on connections at request time today.
  • Content Categories List — Category names for autocomplete and grouping in signature rows.
  • Content File Extensions — Extension regex rows plus extension tags. The matching request-time hook is not implemented.

​
Legacy UI options

Selectors such as Transfer Encoding Chunk, multi-part byte-range, and Trace Entry under Content Signatures are not bound to any template field in this tree — they have no effect here (the same labels on Response Types do affect matching).

​
Examples

​
Maintain a custom MIME tag for DLP autocomplete

  • Content Signatures List: Mime type ^application/x-custom, Added Content Signatures CustomApp
Result: tag name appears in DLP and UI pickers. Connection tags are not added automatically — pair with a Response Types row if policy must match live traffic.

​
Policy on detected downloads (use Response Types)

  • Response Types: Content type ^application/zip, Added Response Types archive-download
Result: live traffic is tagged using response headers and libmagic-detected type; Access Profiles can match archive-download.

​
How to verify

  1. Check module stats / Reports for content signature load or download status.
  2. After editing rows, confirm content4.xml under /var/lib/safesquid/content_signatures/ updates.
  3. For live tagging, verify response_profiles in Detailed logs, not content signature hooks.

​
See also

CLI: man safesquid-contentSignatures

Related topics

Runtime Data and SignaturesCloud / categorisation feedsIntegrationsTools and ReportsSafeSquid daemon