Content Signatures

The Content Signatures section maintains the content-signature database and libmagic MIME detection used across SafeSquid. It helps identify actual file types, bypassing deceptive file extensions — but live connection tagging for policy uses Response Types in the current build.

​

Core mechanics

​

What runs at runtime today

1. On config load and on scheduled update, SafeSquid may download vendor content4.xml and reload the merged database.
2. Custom rows from the Web UI are saved to the dev copy of content4.xml when the section is displayable.
3. The internal MIME engine uses the libmagic database from this directory for body type detection (also used by DLP, logging, and Response Types).
4. The request-time hooks are not implemented — list rows do not add or remove connection tags at request time in the current build.

​

Global Enabled

When off, the section reports itself disabled — signature database download/reload and MIME library setup are affected. List rows are still persisted even when the request-time hooks are inactive.

​

Subsections

• Content Signatures List — MIME regex rows plus tags to add. Stored in config; not applied on connections at request time today.
• Content Categories List — Category names for autocomplete and grouping in signature rows.
• Content File Extensions — Extension regex rows plus extension tags. The matching request-time hook is not implemented.

​

Legacy UI options

Selectors such as Transfer Encoding Chunk, multi-part byte-range, and Trace Entry under Content Signatures are not bound to any template field in this tree — they have no effect here (the same labels on Response Types do affect matching).

​

Schema fields

None of the fields below are matched against live traffic in the current build — see the warnings above.

​

Global

• enabled — master switch for signature database download/reload and MIME-detection library setup. Entries you add are saved regardless of this setting.

​

Content Signatures List

• enabled — off skips the entry on save or reload.
• comment — administrator note.
• Mime type (valueField) — a regex such as ^text/html or ^image/; blank represents all MIME types.
• add_content_signatures — the signature value(s) this entry defines.
• category (group) — category value(s) associated with this entry.

​

Content Categories List

• enabled, comment, add_content_category — same fields as above, applied to a category definition rather than a signature.

​

Content File Extensions

• enabled, comment — same fields as above.
• File Extension (valueField) — a regex; comma-separated patterns are combined as an OR, the same convention Response Types uses; blank represents all extensions.
• add_file_extensions, group — the extension value(s) this entry defines, and its category.

A category name does not require a matching entry in Content Categories List to be usable — that list exists only to populate autocomplete pickers.

​

Examples

​

How to verify

1. Check module stats / Reports for content signature load or download status.
2. After editing rows, confirm content4.xml under /var/lib/safesquid/content_signatures/ updates.
3. For live tagging, verify response_profiles in Detailed logs, not content signature hooks.

​

See also

• Response Types
• DLP
• Application Signatures
• Cloud / categorisation feeds
• Logging and troubleshooting