Bug in X-Forwarded-For?

I'm trying to use Squid 2.2STABLE5 so that I can use the X-Forwarded-For:
variable internally to track who is using our internal proxies, but don't
want our Internet Squid proxy to propogate that info.

Soooo, on the internal Squid servers I use "forwarded_for on", and on the
Internet Squid server I use "forwarded_for off". For good measure I also use
"anonymize_headers deny X-Forwarded-For" on the Internet Squid server to
doubly make sure that header is removed.

But it doesn't work....

If I set "forwarded_for off" on the internal servers, they propogate
"X-Forwarded-For: unknown" out to the Internet Squid server - and so does
it. However, if they have "forwarded_for on", then the Internet Squid server
propogates "X-Forwarded-For: my.ip.address"!

Looks to me like these rules only apply to TCP-based proxy calls - not ICP
ones? Sound correct?

Is there a workaround? Certainly I would have thought the anonymize_headers
call worked across the board...

-- 
Cheers
Jason Haar
Unix/Network Specialist, Trimble NZ
Phone: +64 3 9635 377 Fax: +64 3 9635 417