Each getter walks Compression and buffering policies top-down. The first enabled row whose profiles match wins. Empty profiles match all. No match → built-in defaults.That one matching entry supplies every timing, buffering, and compression value for the connection — values are never mixed across entries, and no entry below it is consulted. It is strictly first-match, not cumulative.
The CONNECT port check applies only when a row matched. Port must be in the row list or CONNECT is blocked. When no row matched, all CONNECT ports are allowed (unless blocked elsewhere).
A policy list with no catch-all leaves CONNECT unrestricted. If every Compression and buffering policies row is scoped to a narrow Profiles value, or the list has no catch-all row at all, CONNECT is completely unrestricted for any connection that matches nothing. If you need CONNECT restricted for all traffic, keep an always-matching row (blank Profiles) last, with the CONNECT ports you intend to enforce.
compressin zero → identity-only upstream Accept-Encoding; non-zero → full encodings (TRUE and AUTO behave the same today). bufferchunked: 0 never, 2 always, 1 encoded-only when Content-Encoding is identity.
maxdbuffer only applies when Content-Length is known and the body is not chunked — a chunked or Content-Length-less response streams through without full buffering regardless of the configured size. bufferwait is the interval between re-sends of the “downloading” holding page while a large response is still buffering. Compress outgoing is effectively always on for SafeSquid’s own Web interface, regardless of what the matched entry says — only traffic to external origins honours the matched entry’s Compress outgoing setting.
The console splits this section into two tabs. Connection pool size and timeout are Global
fields, not a tab of their own — the pool view is a read-only panel reached from Global.
Open Configure → Application Setup → System configuration → Global.
System configuration — Global fields
Proxy hostname (hostname) — Identity in Via and Kerberos scripts; blank uses system hostname. Setting it to your organization’s single LDAP domain name lets users log in without typing the domain themselves.
Connection pool size / timeout (poolsize / pooltimeout) — Resizes upstream serverpool immediately on config update. When the pool is full the oldest pooled connection is dropped to make room; the idle clock resets each time a pooled connection is reused.
Send Debugging Headers To (dheaders) — CLIENT, SERVER, BOTH, or NONE — see Debug headers.
Dynamic Categorization (catreferer) — Referer categories applied to dependency requests, so a permitted page’s sub-resources render instead of showing broken pieces.
A read-only Web UI panel showing the connections currently held open in the pool, or awaiting reuse. Useful for confirming Connection pool size and Connection pool timeout are sized correctly under real load.
Open Configure → Application Setup → System configuration → Compression and buffering
policies. Row fields include Connection/Header/Keepalive timeout, Maximum download/upload buffer
size, Buffer wait time, CONNECT ports, and the compression fields.
System configuration — Compression and buffering policies row
Config: Row 1 profiles text-filter, maxdbuffer 128K above catch-all maxdbuffer 0.Result: Text-filter connections buffer up to 128K; others stream without full download buffer — and a streamed response never reaches the downloaded-body scanners (SqScan, Clam antivirus, Image analyzer, Text analyzer, ICAP). See Architecture and request pipeline for the verified buffered-vs-streamed scanning test.
Config: Entry 1 (top) — Profiles blank, CONNECT ports 80,443,21,1025-65535. Entry 2 (below) — Profiles text-filter, Maximum download buffer size 128M.Result: every connection matches entry 1 first, because it has no Profiles restriction — entry 2 never applies to anything. The fix is to move entry 2 above entry 1, so text-filter connections get its buffer size before the catch-all claims them.
