squid默认并不是以root用户启动的进程，而且即使设置为以root用户启动也是无法生效的。
所以，如果想给socket打mark即调用setsockopt API函数的话需要权限来进行操作。
提权就很重要，libcap类库就是来干这个事情的。具体是在tools.cc文件中的函数实现restoreCapabilities 中CAP_NET_ADMIN就是提权的能力使能。
static void
restoreCapabilities(bool keep)
{
/* NP: keep these two if-endif separate. Non-Linux work perfectly well without Linux syscap support. */
#if USE_LIBCAP
cap_t caps;
if (keep)
caps = cap_get_proc();
else
caps = cap_init();
if (!caps) {
Ip::Interceptor.StopTransparency("Can't get current capabilities");
} else {
int ncaps = 0;
int rc = 0;
cap_value_t cap_list[10];
cap_list[ncaps] = CAP_NET_BIND_SERVICE;
++ncaps;
if (Ip::Interceptor.TransparentActive() ||
Ip::Qos::TheConfig.isHitNfmarkActive() ||
Ip::Qos::TheConfig.isAclNfmarkActive() ||
Ip::Qos::TheConfig.isAclTosActive()) {
cap_list[ncaps] = CAP_NET_ADMIN;
++ncaps;
}
cap_clear_flag(caps, CAP_EFFECTIVE);
rc |= cap_set_flag(caps, CAP_EFFECTIVE, ncaps, cap_list, CAP_SET);
rc |= cap_set_flag(caps, CAP_PERMITTED, ncaps, cap_list, CAP_SET);
if (rc || cap_set_proc(caps) != 0) {
Ip::Interceptor.StopTransparency("Error enabling needed capabilities.");
}
cap_free(caps);
}
#elif _SQUID_LINUX_
Ip::Interceptor.StopTransparency("Missing needed capability support.");
#endif /* HAVE_SYS_CAPABILITY_H */
}
zph 即Zero-Penalty Hit这个算法并不是真正意义上的Qos，而是基于命中的一种实现
Zero Penalty Hit created a patch to set QoS markers on outgoing traffic to clients.
Allows you to select a TOS/Diffserv value to mark local hits.
Allows you to select a TOS/Diffserv value to mark peer hits.
Allows you to selectively set only sibling or parent requests
Allows any HTTP response to clients will have the TOS value of the response coming from the remote server masked. For this to work correctly, you will need to patch your linux kernel with the TOS preserving ZPH patch. The kernel patch can be downloaded from http://zph.bratcheda.org
Allows you to mask certain bits in the TOS received from the remote server, before copying the value to the TOS send towards clients.