diff --git a/.cvsignore b/.cvsignore
index bedd188..aced258 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,7 @@
 squid-3.1.0.15.tar.bz2
 squid-3.1.0.15.tar.bz2.asc
+squid-3.1-9816.patch
+squid-3.1-9818.patch
+squid-3.1-9822.patch
+squid-3.1-9826.patch
+squid-3.1-9827.patch
diff --git a/sources b/sources
index 5d455ac..8b6c078 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,7 @@
 295f5c6067244cf8537600be0b9841d7  squid-3.1.0.15.tar.bz2
 f93fb0b6f72f9cd4fb03b931f66d7308  squid-3.1.0.15.tar.bz2.asc
+eeada33894e7b2f1087584cabc610ae6  squid-3.1-9816.patch
+ee68af7fbff4c9571ed22326eb0c59dc  squid-3.1-9818.patch
+fa645851b2dfce355e465cbe0e27404d  squid-3.1-9822.patch
+02a49a40917c50995a37d2d29c80591c  squid-3.1-9826.patch
+0f6b14245d9708d4abda922ad4668b4c  squid-3.1-9827.patch
diff --git a/squid.spec b/squid.spec
index ef2b95e..82aec6e 100644
--- a/squid.spec
+++ b/squid.spec
@@ -4,7 +4,7 @@
 
 Name:     squid
 Version:  3.1.0.15
-Release:  2%{?dist}
+Release:  3%{?dist}
 Summary:  The Squid proxy caching server
 Epoch:    7
 License:  GPLv2+
@@ -22,6 +22,11 @@ Source98: perl-requires-squid.sh
 
 # Upstream patches
 #Patch001: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-XXXXX.patch
+Patch001: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-9816.patch
+Patch002: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-9818.patch
+Patch003: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-9822.patch
+Patch004: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-9826.patch
+Patch005: http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-9827.patch
 
 # Local patches
 # Applying upstream patches first makes it less likely that local patches
@@ -50,6 +55,8 @@ BuildRequires: krb5-devel
 BuildRequires: db4-devel
 # ESI support requires Expat & libxml2
 BuildRequires: expat-devel libxml2-devel
+# TPROXY requires libcap, and also increases security somewhat
+BuildRequires: libcap-devel
 Obsoletes: squid-novm
 
 %description
@@ -67,6 +74,12 @@ lookup program (dnsserver), a program for retrieving FTP data
 %prep
 %setup -q
 
+%patch001 -p0 -b .9816
+%patch002 -p0 -b .9818
+%patch003 -p0 -b .9822
+%patch004 -p0 -b .9826
+%patch005 -p0 -b .9827
+
 %patch201 -p1 -b .config
 %patch202 -p1 -b .location
 %patch204 -p1 -b .perlpath
@@ -252,6 +265,10 @@ fi
     chgrp squid /var/cache/samba/winbindd_privileged >/dev/null 2>&1 || :
 
 %changelog
+* Sat Jan 09 2010 Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.15-3
+- fixed #551302 PROXY needs libcap. Also increases security a little.
+- merged relevant upstream bugfixes waiting for next 3.1 release
+
 * Mon Nov 23 2009 Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.15-2
 - Update to 3.1.0.15 with a number of bugfixes and a workaround for
   ICEcast/SHOUTcast streams.