8b0621
diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
8b0621
index de48735..d13c249 100644
8b0621
--- a/modules/proxy/mod_proxy.c
8b0621
+++ b/modules/proxy/mod_proxy.c
8b0621
@@ -1574,6 +1574,8 @@ static void *create_proxy_dir_config(apr_pool_t *p, char *dummy)
8b0621
     new->error_override_set = 0;
8b0621
     new->add_forwarded_headers = 1;
8b0621
     new->add_forwarded_headers_set = 0;
8b0621
+    new->forward_100_continue = 1;
8b0621
+    new->forward_100_continue_set = 0;
8b0621
 
8b0621
     return (void *) new;
8b0621
 }
8b0621
@@ -1610,6 +1612,11 @@ static void *merge_proxy_dir_config(apr_pool_t *p, void *basev, void *addv)
8b0621
         : add->add_forwarded_headers;
8b0621
     new->add_forwarded_headers_set = add->add_forwarded_headers_set
8b0621
         || base->add_forwarded_headers_set;
8b0621
+    new->forward_100_continue =
8b0621
+        (add->forward_100_continue_set == 0) ? base->forward_100_continue
8b0621
+                                             : add->forward_100_continue;
8b0621
+    new->forward_100_continue_set = add->forward_100_continue_set
8b0621
+                                    || base->forward_100_continue_set;
8b0621
     
8b0621
     return new;
8b0621
 }
8b0621
@@ -2110,6 +2117,14 @@ static const char *
8b0621
     conf->preserve_host_set = 1;
8b0621
     return NULL;
8b0621
 }
8b0621
+static const char *
8b0621
+   forward_100_continue(cmd_parms *parms, void *dconf, int flag)
8b0621
+{
8b0621
+   proxy_dir_conf *conf = dconf;
8b0621
+   conf->forward_100_continue = flag;
8b0621
+   conf->forward_100_continue_set = 1;
8b0621
+   return NULL;
8b0621
+}
8b0621
 
8b0621
 static const char *
8b0621
     set_recv_buffer_size(cmd_parms *parms, void *dummy, const char *arg)
8b0621
@@ -2683,6 +2698,9 @@ static const command_rec proxy_cmds[] =
8b0621
      "Configure local source IP used for request forward"),
8b0621
     AP_INIT_FLAG("ProxyAddHeaders", add_proxy_http_headers, NULL, RSRC_CONF|ACCESS_CONF,
8b0621
      "on if X-Forwarded-* headers should be added or completed"),
8b0621
+    AP_INIT_FLAG("Proxy100Continue", forward_100_continue, NULL, RSRC_CONF|ACCESS_CONF,
8b0621
+     "on if 100-Continue should be forwarded to the origin server, off if the "
8b0621
+     "proxy should handle it by itself"),
8b0621
     {NULL}
8b0621
 };
8b0621
 
8b0621
diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
8b0621
index 3419023..288c5d4 100644
8b0621
--- a/modules/proxy/mod_proxy.h
8b0621
+++ b/modules/proxy/mod_proxy.h
8b0621
@@ -240,6 +240,8 @@ typedef struct {
8b0621
     /** Named back references */
8b0621
     apr_array_header_t *refs;
8b0621
 
8b0621
+    unsigned int forward_100_continue:1;
8b0621
+    unsigned int forward_100_continue_set:1;
8b0621
 } proxy_dir_conf;
8b0621
 
8b0621
 /* if we interpolate env vars per-request, we'll need a per-request
8b0621
@@ -380,6 +382,12 @@ do {                             \
8b0621
 (w)->s->io_buffer_size_set   = (c)->io_buffer_size_set;    \
8b0621
 } while (0)
8b0621
 
8b0621
+#define PROXY_DO_100_CONTINUE(w, r) \
8b0621
+((w)->s->ping_timeout_set \
8b0621
+ && (PROXYREQ_REVERSE == (r)->proxyreq) \
8b0621
+ && !(apr_table_get((r)->subprocess_env, "force-proxy-request-1.0")) \
8b0621
+ && ap_request_has_body((r)))
8b0621
+
8b0621
 /* use 2 hashes */
8b0621
 typedef struct {
8b0621
     unsigned int def;
8b0621
diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c
8b0621
index 8f6f853..8d66b4a 100644
8b0621
--- a/modules/proxy/mod_proxy_ftp.c
8b0621
+++ b/modules/proxy/mod_proxy_ftp.c
8b0621
@@ -1181,12 +1181,10 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker,
8b0621
         return HTTP_SERVICE_UNAVAILABLE;
8b0621
     }
8b0621
 
8b0621
-    if (!backend->connection) {
8b0621
-        status = ap_proxy_connection_create_ex("FTP", backend, r);
8b0621
-        if (status != OK) {
8b0621
-            proxy_ftp_cleanup(r, backend);
8b0621
-            return status;
8b0621
-        }
8b0621
+    status = ap_proxy_connection_create_ex("FTP", backend, r);
8b0621
+    if (status != OK) {
8b0621
+        proxy_ftp_cleanup(r, backend);
8b0621
+        return status;
8b0621
     }
8b0621
 
8b0621
     /* Use old naming */
8b0621
diff --git a/modules/proxy/mod_proxy_hcheck.c b/modules/proxy/mod_proxy_hcheck.c
8b0621
index 2783a58..dd8e407 100644
8b0621
--- a/modules/proxy/mod_proxy_hcheck.c
8b0621
+++ b/modules/proxy/mod_proxy_hcheck.c
8b0621
@@ -762,10 +762,8 @@ static apr_status_t hc_check_http(baton_t *baton)
8b0621
     }
8b0621
 
8b0621
     r = create_request_rec(ptemp, ctx->s, baton->balancer, wctx->method);
8b0621
-    if (!backend->connection) {
8b0621
-        if ((status = ap_proxy_connection_create_ex("HCOH", backend, r)) != OK) {
8b0621
-            return backend_cleanup("HCOH", backend, ctx->s, status);
8b0621
-        }
8b0621
+    if ((status = ap_proxy_connection_create_ex("HCOH", backend, r)) != OK) {
8b0621
+        return backend_cleanup("HCOH", backend, ctx->s, status);
8b0621
     }
8b0621
     set_request_connection(r, backend->connection);
8b0621
 
8b0621
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
8b0621
index 56af9a8..f007ad6 100644
8b0621
--- a/modules/proxy/mod_proxy_http.c
8b0621
+++ b/modules/proxy/mod_proxy_http.c
8b0621
@@ -216,8 +216,12 @@ static void add_cl(apr_pool_t *p,
8b0621
     APR_BRIGADE_INSERT_TAIL(header_brigade, e);
8b0621
 }
8b0621
 
8b0621
-#define ASCII_CRLF  "\015\012"
8b0621
-#define ASCII_ZERO  "\060"
8b0621
+#ifndef CRLF_ASCII
8b0621
+#define CRLF_ASCII  "\015\012"
8b0621
+#endif
8b0621
+#ifndef ZERO_ASCII
8b0621
+#define ZERO_ASCII  "\060"
8b0621
+#endif
8b0621
 
8b0621
 static void terminate_headers(apr_bucket_alloc_t *bucket_alloc,
8b0621
                               apr_bucket_brigade *header_brigade)
8b0621
@@ -225,304 +229,228 @@ static void terminate_headers(apr_bucket_alloc_t *bucket_alloc,
8b0621
     apr_bucket *e;
8b0621
 
8b0621
     /* add empty line at the end of the headers */
8b0621
-    e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
8b0621
+    e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
8b0621
     APR_BRIGADE_INSERT_TAIL(header_brigade, e);
8b0621
 }
8b0621
 
8b0621
 
8b0621
 #define MAX_MEM_SPOOL 16384
8b0621
 
8b0621
-static int stream_reqbody_chunked(apr_pool_t *p,
8b0621
-                                           request_rec *r,
8b0621
-                                           proxy_conn_rec *p_conn,
8b0621
-                                           conn_rec *origin,
8b0621
-                                           apr_bucket_brigade *header_brigade,
8b0621
-                                           apr_bucket_brigade *input_brigade)
8b0621
-{
8b0621
-    int seen_eos = 0, rv = OK;
8b0621
-    apr_size_t hdr_len;
8b0621
-    apr_off_t bytes;
8b0621
-    apr_status_t status;
8b0621
-    apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc;
8b0621
-    apr_bucket_brigade *bb;
8b0621
-    apr_bucket *e;
8b0621
-
8b0621
-    add_te_chunked(p, bucket_alloc, header_brigade);
8b0621
-    terminate_headers(bucket_alloc, header_brigade);
8b0621
+typedef enum {
8b0621
+    RB_INIT = 0,
8b0621
+    RB_STREAM_CL,
8b0621
+    RB_STREAM_CHUNKED,
8b0621
+    RB_SPOOL_CL
8b0621
+} rb_methods;
8b0621
 
8b0621
-    while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade)))
8b0621
-    {
8b0621
-        char chunk_hdr[20];  /* must be here due to transient bucket. */
8b0621
+typedef struct {
8b0621
+    apr_pool_t *p;
8b0621
+    request_rec *r;
8b0621
+    proxy_worker *worker;
8b0621
+    proxy_server_conf *sconf;
8b0621
 
8b0621
-        /* If this brigade contains EOS, either stop or remove it. */
8b0621
-        if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
8b0621
-            seen_eos = 1;
8b0621
-
8b0621
-            /* We can't pass this EOS to the output_filters. */
8b0621
-            e = APR_BRIGADE_LAST(input_brigade);
8b0621
-            apr_bucket_delete(e);
8b0621
-        }
8b0621
-
8b0621
-        apr_brigade_length(input_brigade, 1, &bytes);
8b0621
+    char server_portstr[32];
8b0621
+    proxy_conn_rec *backend;
8b0621
+    conn_rec *origin;
8b0621
 
8b0621
-        hdr_len = apr_snprintf(chunk_hdr, sizeof(chunk_hdr),
8b0621
-                               "%" APR_UINT64_T_HEX_FMT CRLF,
8b0621
-                               (apr_uint64_t)bytes);
8b0621
+    apr_bucket_alloc_t *bucket_alloc;
8b0621
+    apr_bucket_brigade *header_brigade;
8b0621
+    apr_bucket_brigade *input_brigade;
8b0621
+    char *old_cl_val, *old_te_val;
8b0621
+    apr_off_t cl_val;
8b0621
 
8b0621
-        ap_xlate_proto_to_ascii(chunk_hdr, hdr_len);
8b0621
-        e = apr_bucket_transient_create(chunk_hdr, hdr_len,
8b0621
-                                        bucket_alloc);
8b0621
-        APR_BRIGADE_INSERT_HEAD(input_brigade, e);
8b0621
+    rb_methods rb_method;
8b0621
 
8b0621
-        /*
8b0621
-         * Append the end-of-chunk CRLF
8b0621
-         */
8b0621
-        e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
8b0621
-        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
8b0621
+    int expecting_100;
8b0621
+    unsigned int do_100_continue:1,
8b0621
+                 prefetch_nonblocking:1;
8b0621
+} proxy_http_req_t;
8b0621
 
8b0621
-        if (header_brigade) {
8b0621
-            /* we never sent the header brigade, so go ahead and
8b0621
-             * take care of that now
8b0621
-             */
8b0621
-            bb = header_brigade;
8b0621
-
8b0621
-            /*
8b0621
-             * Save input_brigade in bb brigade. (At least) in the SSL case
8b0621
-             * input_brigade contains transient buckets whose data would get
8b0621
-             * overwritten during the next call of ap_get_brigade in the loop.
8b0621
-             * ap_save_brigade ensures these buckets to be set aside.
8b0621
-             * Calling ap_save_brigade with NULL as filter is OK, because
8b0621
-             * bb brigade already has been created and does not need to get
8b0621
-             * created by ap_save_brigade.
8b0621
-             */
8b0621
-            status = ap_save_brigade(NULL, &bb, &input_brigade, p);
8b0621
-            if (status != APR_SUCCESS) {
8b0621
-                return HTTP_INTERNAL_SERVER_ERROR;
8b0621
-            }
8b0621
-
8b0621
-            header_brigade = NULL;
8b0621
-        }
8b0621
-        else {
8b0621
-            bb = input_brigade;
8b0621
+/* Read what's in the client pipe. If nonblocking is set and read is EAGAIN,
8b0621
+ * pass a FLUSH bucket to the backend and read again in blocking mode.
8b0621
+ */
8b0621
+static int stream_reqbody_read(proxy_http_req_t *req, apr_bucket_brigade *bb,
8b0621
+                               int nonblocking)
8b0621
+{
8b0621
+    request_rec *r = req->r;
8b0621
+    proxy_conn_rec *p_conn = req->backend;
8b0621
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
8b0621
+    apr_read_type_e block = nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ;
8b0621
+    apr_status_t status;
8b0621
+    int rv;
8b0621
+
8b0621
+    for (;;) {
8b0621
+        status = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
8b0621
+                                block, HUGE_STRING_LEN);
8b0621
+        if (block == APR_BLOCK_READ
8b0621
+                || (!APR_STATUS_IS_EAGAIN(status)
8b0621
+                    && (status != APR_SUCCESS || !APR_BRIGADE_EMPTY(bb)))) {
8b0621
+            break;
8b0621
         }
8b0621
 
8b0621
-        /* The request is flushed below this loop with chunk EOS header */
8b0621
-        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 0);
8b0621
+        /* Flush and retry (blocking) */
8b0621
+        apr_brigade_cleanup(bb);
8b0621
+        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin, bb, 1);
8b0621
         if (rv != OK) {
8b0621
             return rv;
8b0621
         }
8b0621
-
8b0621
-        if (seen_eos) {
8b0621
-            break;
8b0621
-        }
8b0621
-
8b0621
-        status = ap_get_brigade(r->input_filters, input_brigade,
8b0621
-                                AP_MODE_READBYTES, APR_BLOCK_READ,
8b0621
-                                HUGE_STRING_LEN);
8b0621
-
8b0621
-        if (status != APR_SUCCESS) {
8b0621
-            conn_rec *c = r->connection;
8b0621
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608)
8b0621
-                          "read request body failed to %pI (%s)"
8b0621
-                          " from %s (%s)", p_conn->addr,
8b0621
-                          p_conn->hostname ? p_conn->hostname: "",
8b0621
-                          c->client_ip, c->remote_host ? c->remote_host: "");
8b0621
-            return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
8b0621
-        }
8b0621
+        block = APR_BLOCK_READ;
8b0621
     }
8b0621
 
8b0621
-    if (header_brigade) {
8b0621
-        /* we never sent the header brigade because there was no request body;
8b0621
-         * send it now
8b0621
-         */
8b0621
-        bb = header_brigade;
8b0621
-    }
8b0621
-    else {
8b0621
-        if (!APR_BRIGADE_EMPTY(input_brigade)) {
8b0621
-            /* input brigade still has an EOS which we can't pass to the output_filters. */
8b0621
-            e = APR_BRIGADE_LAST(input_brigade);
8b0621
-            AP_DEBUG_ASSERT(APR_BUCKET_IS_EOS(e));
8b0621
-            apr_bucket_delete(e);
8b0621
-        }
8b0621
-        bb = input_brigade;
8b0621
-    }
8b0621
-
8b0621
-    e = apr_bucket_immortal_create(ASCII_ZERO ASCII_CRLF
8b0621
-                                   /* <trailers> */
8b0621
-                                   ASCII_CRLF,
8b0621
-                                   5, bucket_alloc);
8b0621
-    APR_BRIGADE_INSERT_TAIL(bb, e);
8b0621
-
8b0621
-    if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) {
8b0621
-        e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
8b0621
-        APR_BRIGADE_INSERT_TAIL(bb, e);
8b0621
+    if (status != APR_SUCCESS) {
8b0621
+        conn_rec *c = r->connection;
8b0621
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608)
8b0621
+                      "read request body failed to %pI (%s)"
8b0621
+                      " from %s (%s)", p_conn->addr,
8b0621
+                      p_conn->hostname ? p_conn->hostname: "",
8b0621
+                      c->client_ip, c->remote_host ? c->remote_host: "");
8b0621
+        return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
8b0621
     }
8b0621
 
8b0621
-    /* Now we have headers-only, or the chunk EOS mark; flush it */
8b0621
-    rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 1);
8b0621
-    return rv;
8b0621
+    return OK;
8b0621
 }
8b0621
 
8b0621
-static int stream_reqbody_cl(apr_pool_t *p,
8b0621
-                                      request_rec *r,
8b0621
-                                      proxy_conn_rec *p_conn,
8b0621
-                                      conn_rec *origin,
8b0621
-                                      apr_bucket_brigade *header_brigade,
8b0621
-                                      apr_bucket_brigade *input_brigade,
8b0621
-                                      char *old_cl_val)
8b0621
+static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method)
8b0621
 {
8b0621
-    int seen_eos = 0, rv = 0;
8b0621
-    apr_status_t status = APR_SUCCESS;
8b0621
-    apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc;
8b0621
-    apr_bucket_brigade *bb;
8b0621
+    request_rec *r = req->r;
8b0621
+    int seen_eos = 0, rv = OK;
8b0621
+    apr_size_t hdr_len;
8b0621
+    char chunk_hdr[20];  /* must be here due to transient bucket. */
8b0621
+    proxy_conn_rec *p_conn = req->backend;
8b0621
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
8b0621
+    apr_bucket_brigade *header_brigade = req->header_brigade;
8b0621
+    apr_bucket_brigade *input_brigade = req->input_brigade;
8b0621
+    apr_off_t bytes, bytes_streamed = 0;
8b0621
     apr_bucket *e;
8b0621
-    apr_off_t cl_val = 0;
8b0621
-    apr_off_t bytes;
8b0621
-    apr_off_t bytes_streamed = 0;
8b0621
-
8b0621
-    if (old_cl_val) {
8b0621
-        char *endstr;
8b0621
 
8b0621
-        add_cl(p, bucket_alloc, header_brigade, old_cl_val);
8b0621
-        status = apr_strtoff(&cl_val, old_cl_val, &endstr, 10);
8b0621
-
8b0621
-        if (status || *endstr || endstr == old_cl_val || cl_val < 0) {
8b0621
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01085)
8b0621
-                          "could not parse request Content-Length (%s)",
8b0621
-                          old_cl_val);
8b0621
-            return HTTP_BAD_REQUEST;
8b0621
+    do {
8b0621
+        if (APR_BRIGADE_EMPTY(input_brigade)
8b0621
+                && APR_BRIGADE_EMPTY(header_brigade)) {
8b0621
+            rv = stream_reqbody_read(req, input_brigade, 1);
8b0621
+            if (rv != OK) {
8b0621
+                return rv;
8b0621
+            }
8b0621
         }
8b0621
-    }
8b0621
-    terminate_headers(bucket_alloc, header_brigade);
8b0621
-
8b0621
-    while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade)))
8b0621
-    {
8b0621
-        apr_brigade_length(input_brigade, 1, &bytes);
8b0621
-        bytes_streamed += bytes;
8b0621
-
8b0621
-        /* If this brigade contains EOS, either stop or remove it. */
8b0621
-        if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
8b0621
-            seen_eos = 1;
8b0621
 
8b0621
-            /* We can't pass this EOS to the output_filters. */
8b0621
-            e = APR_BRIGADE_LAST(input_brigade);
8b0621
-            apr_bucket_delete(e);
8b0621
+        if (!APR_BRIGADE_EMPTY(input_brigade)) {
8b0621
+            /* If this brigade contains EOS, either stop or remove it. */
8b0621
+            if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
8b0621
+                seen_eos = 1;
8b0621
 
8b0621
-            if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) {
8b0621
-                e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
8b0621
-                APR_BRIGADE_INSERT_TAIL(input_brigade, e);
8b0621
+                /* We can't pass this EOS to the output_filters. */
8b0621
+                e = APR_BRIGADE_LAST(input_brigade);
8b0621
+                apr_bucket_delete(e);
8b0621
             }
8b0621
-        }
8b0621
 
8b0621
-        /* C-L < bytes streamed?!?
8b0621
-         * We will error out after the body is completely
8b0621
-         * consumed, but we can't stream more bytes at the
8b0621
-         * back end since they would in part be interpreted
8b0621
-         * as another request!  If nothing is sent, then
8b0621
-         * just send nothing.
8b0621
-         *
8b0621
-         * Prevents HTTP Response Splitting.
8b0621
-         */
8b0621
-        if (bytes_streamed > cl_val) {
8b0621
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01086)
8b0621
-                          "read more bytes of request body than expected "
8b0621
-                          "(got %" APR_OFF_T_FMT ", expected %" APR_OFF_T_FMT ")",
8b0621
-                          bytes_streamed, cl_val);
8b0621
-            return HTTP_INTERNAL_SERVER_ERROR;
8b0621
-        }
8b0621
-
8b0621
-        if (header_brigade) {
8b0621
-            /* we never sent the header brigade, so go ahead and
8b0621
-             * take care of that now
8b0621
-             */
8b0621
-            bb = header_brigade;
8b0621
+            apr_brigade_length(input_brigade, 1, &bytes);
8b0621
+            bytes_streamed += bytes;
8b0621
 
8b0621
-            /*
8b0621
-             * Save input_brigade in bb brigade. (At least) in the SSL case
8b0621
-             * input_brigade contains transient buckets whose data would get
8b0621
-             * overwritten during the next call of ap_get_brigade in the loop.
8b0621
-             * ap_save_brigade ensures these buckets to be set aside.
8b0621
-             * Calling ap_save_brigade with NULL as filter is OK, because
8b0621
-             * bb brigade already has been created and does not need to get
8b0621
-             * created by ap_save_brigade.
8b0621
-             */
8b0621
-            status = ap_save_brigade(NULL, &bb, &input_brigade, p);
8b0621
-            if (status != APR_SUCCESS) {
8b0621
+            if (rb_method == RB_STREAM_CHUNKED) {
8b0621
+                if (bytes) {
8b0621
+                    /*
8b0621
+                     * Prepend the size of the chunk
8b0621
+                     */
8b0621
+                    hdr_len = apr_snprintf(chunk_hdr, sizeof(chunk_hdr),
8b0621
+                                           "%" APR_UINT64_T_HEX_FMT CRLF,
8b0621
+                                           (apr_uint64_t)bytes);
8b0621
+                    ap_xlate_proto_to_ascii(chunk_hdr, hdr_len);
8b0621
+                    e = apr_bucket_transient_create(chunk_hdr, hdr_len,
8b0621
+                                                    bucket_alloc);
8b0621
+                    APR_BRIGADE_INSERT_HEAD(input_brigade, e);
8b0621
+
8b0621
+                    /*
8b0621
+                     * Append the end-of-chunk CRLF
8b0621
+                     */
8b0621
+                    e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
8b0621
+                    APR_BRIGADE_INSERT_TAIL(input_brigade, e);
8b0621
+                }
8b0621
+                if (seen_eos) {
8b0621
+                    /*
8b0621
+                     * Append the tailing 0-size chunk
8b0621
+                     */
8b0621
+                    e = apr_bucket_immortal_create(ZERO_ASCII CRLF_ASCII
8b0621
+                                                   /* <trailers> */
8b0621
+                                                   CRLF_ASCII,
8b0621
+                                                   5, bucket_alloc);
8b0621
+                    APR_BRIGADE_INSERT_TAIL(input_brigade, e);
8b0621
+                }
8b0621
+            }
8b0621
+            else if (bytes_streamed > req->cl_val) {
8b0621
+                /* C-L < bytes streamed?!?
8b0621
+                 * We will error out after the body is completely
8b0621
+                 * consumed, but we can't stream more bytes at the
8b0621
+                 * back end since they would in part be interpreted
8b0621
+                 * as another request!  If nothing is sent, then
8b0621
+                 * just send nothing.
8b0621
+                 *
8b0621
+                 * Prevents HTTP Response Splitting.
8b0621
+                 */
8b0621
+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01086)
8b0621
+                              "read more bytes of request body than expected "
8b0621
+                              "(got %" APR_OFF_T_FMT ", expected "
8b0621
+                              "%" APR_OFF_T_FMT ")",
8b0621
+                              bytes_streamed, req->cl_val);
8b0621
                 return HTTP_INTERNAL_SERVER_ERROR;
8b0621
             }
8b0621
 
8b0621
-            header_brigade = NULL;
8b0621
-        }
8b0621
-        else {
8b0621
-            bb = input_brigade;
8b0621
-        }
8b0621
-
8b0621
-        /* Once we hit EOS, we are ready to flush. */
8b0621
-        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, seen_eos);
8b0621
-        if (rv != OK) {
8b0621
-            return rv ;
8b0621
-        }
8b0621
-
8b0621
-        if (seen_eos) {
8b0621
-            break;
8b0621
+            if (seen_eos && apr_table_get(r->subprocess_env,
8b0621
+                                          "proxy-sendextracrlf")) {
8b0621
+                e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
8b0621
+                APR_BRIGADE_INSERT_TAIL(input_brigade, e);
8b0621
+            }
8b0621
         }
8b0621
 
8b0621
-        status = ap_get_brigade(r->input_filters, input_brigade,
8b0621
-                                AP_MODE_READBYTES, APR_BLOCK_READ,
8b0621
-                                HUGE_STRING_LEN);
8b0621
+        /* If we never sent the header brigade, go ahead and take care of
8b0621
+         * that now by prepending it (once only since header_brigade will be
8b0621
+         * empty afterward).
8b0621
+         */
8b0621
+        APR_BRIGADE_PREPEND(input_brigade, header_brigade);
8b0621
 
8b0621
-        if (status != APR_SUCCESS) {
8b0621
-            conn_rec *c = r->connection;
8b0621
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02609)
8b0621
-                          "read request body failed to %pI (%s)"
8b0621
-                          " from %s (%s)", p_conn->addr,
8b0621
-                          p_conn->hostname ? p_conn->hostname: "",
8b0621
-                          c->client_ip, c->remote_host ? c->remote_host: "");
8b0621
-            return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
8b0621
+        /* Flush here on EOS because we won't stream_reqbody_read() again */
8b0621
+        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin,
8b0621
+                                   input_brigade, seen_eos);
8b0621
+        if (rv != OK) {
8b0621
+            return rv;
8b0621
         }
8b0621
-    }
8b0621
+    } while (!seen_eos);
8b0621
 
8b0621
-    if (bytes_streamed != cl_val) {
8b0621
+    if (rb_method == RB_STREAM_CL && bytes_streamed != req->cl_val) {
8b0621
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01087)
8b0621
                       "client %s given Content-Length did not match"
8b0621
                       " number of body bytes read", r->connection->client_ip);
8b0621
         return HTTP_BAD_REQUEST;
8b0621
     }
8b0621
 
8b0621
-    if (header_brigade) {
8b0621
-        /* we never sent the header brigade since there was no request
8b0621
-         * body; send it now with the flush flag
8b0621
-         */
8b0621
-        bb = header_brigade;
8b0621
-        return(ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 1));
8b0621
-    }
8b0621
-
8b0621
     return OK;
8b0621
 }
8b0621
 
8b0621
-static int spool_reqbody_cl(apr_pool_t *p,
8b0621
-                                     request_rec *r,
8b0621
-                                     proxy_conn_rec *p_conn,
8b0621
-                                     conn_rec *origin,
8b0621
-                                     apr_bucket_brigade *header_brigade,
8b0621
-                                     apr_bucket_brigade *input_brigade,
8b0621
-                                     int force_cl)
8b0621
+static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled)
8b0621
 {
8b0621
-    int seen_eos = 0;
8b0621
-    apr_status_t status;
8b0621
-    apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc;
8b0621
+    apr_pool_t *p = req->p;
8b0621
+    request_rec *r = req->r;
8b0621
+    int seen_eos = 0, rv = OK;
8b0621
+    apr_status_t status = APR_SUCCESS;
8b0621
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
8b0621
+    apr_bucket_brigade *input_brigade = req->input_brigade;
8b0621
     apr_bucket_brigade *body_brigade;
8b0621
     apr_bucket *e;
8b0621
-    apr_off_t bytes, bytes_spooled = 0, fsize = 0;
8b0621
+    apr_off_t bytes, fsize = 0;
8b0621
     apr_file_t *tmpfile = NULL;
8b0621
     apr_off_t limit;
8b0621
 
8b0621
     body_brigade = apr_brigade_create(p, bucket_alloc);
8b0621
+    *bytes_spooled = 0;
8b0621
 
8b0621
     limit = ap_get_limit_req_body(r);
8b0621
 
8b0621
-    while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade)))
8b0621
-    {
8b0621
+    do {
8b0621
+        if (APR_BRIGADE_EMPTY(input_brigade)) {
8b0621
+            rv = stream_reqbody_read(req, input_brigade, 0);
8b0621
+            if (rv != OK) {
8b0621
+                return rv;
8b0621
+            }
8b0621
+        }
8b0621
+
8b0621
         /* If this brigade contains EOS, either stop or remove it. */
8b0621
         if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
8b0621
             seen_eos = 1;
8b0621
@@ -534,13 +462,13 @@ static int spool_reqbody_cl(apr_pool_t *p,
8b0621
 
8b0621
         apr_brigade_length(input_brigade, 1, &bytes);
8b0621
 
8b0621
-        if (bytes_spooled + bytes > MAX_MEM_SPOOL) {
8b0621
+        if (*bytes_spooled + bytes > MAX_MEM_SPOOL) {
8b0621
             /*
8b0621
              * LimitRequestBody does not affect Proxy requests (Should it?).
8b0621
              * Let it take effect if we decide to store the body in a
8b0621
              * temporary file on disk.
8b0621
              */
8b0621
-            if (limit && (bytes_spooled + bytes > limit)) {
8b0621
+            if (limit && (*bytes_spooled + bytes > limit)) {
8b0621
                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088)
8b0621
                               "Request body is larger than the configured "
8b0621
                               "limit of %" APR_OFF_T_FMT, limit);
8b0621
@@ -610,69 +538,42 @@ static int spool_reqbody_cl(apr_pool_t *p,
8b0621
 
8b0621
         }
8b0621
 
8b0621
-        bytes_spooled += bytes;
8b0621
-
8b0621
-        if (seen_eos) {
8b0621
-            break;
8b0621
-        }
8b0621
-
8b0621
-        status = ap_get_brigade(r->input_filters, input_brigade,
8b0621
-                                AP_MODE_READBYTES, APR_BLOCK_READ,
8b0621
-                                HUGE_STRING_LEN);
8b0621
-
8b0621
-        if (status != APR_SUCCESS) {
8b0621
-            conn_rec *c = r->connection;
8b0621
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02610)
8b0621
-                          "read request body failed to %pI (%s)"
8b0621
-                          " from %s (%s)", p_conn->addr,
8b0621
-                          p_conn->hostname ? p_conn->hostname: "",
8b0621
-                          c->client_ip, c->remote_host ? c->remote_host: "");
8b0621
-            return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
8b0621
-        }
8b0621
-    }
8b0621
+        *bytes_spooled += bytes;
8b0621
+    } while (!seen_eos);
8b0621
 
8b0621
-    if (bytes_spooled || force_cl) {
8b0621
-        add_cl(p, bucket_alloc, header_brigade, apr_off_t_toa(p, bytes_spooled));
8b0621
-    }
8b0621
-    terminate_headers(bucket_alloc, header_brigade);
8b0621
-    APR_BRIGADE_CONCAT(header_brigade, body_brigade);
8b0621
+    APR_BRIGADE_CONCAT(input_brigade, body_brigade);
8b0621
     if (tmpfile) {
8b0621
-        apr_brigade_insert_file(header_brigade, tmpfile, 0, fsize, p);
8b0621
+        apr_brigade_insert_file(input_brigade, tmpfile, 0, fsize, p);
8b0621
     }
8b0621
     if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) {
8b0621
-        e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
8b0621
-        APR_BRIGADE_INSERT_TAIL(header_brigade, e);
8b0621
+        e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
8b0621
+        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
8b0621
     }
8b0621
-    /* This is all a single brigade, pass with flush flagged */
8b0621
-    return(ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, header_brigade, 1));
8b0621
+    return OK;
8b0621
 }
8b0621
 
8b0621
-static
8b0621
-int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
-                                   proxy_conn_rec *p_conn, proxy_worker *worker,
8b0621
-                                   proxy_server_conf *conf,
8b0621
-                                   apr_uri_t *uri,
8b0621
-                                   char *url, char *server_portstr)
8b0621
+static int ap_proxy_http_prefetch(proxy_http_req_t *req,
8b0621
+                                  apr_uri_t *uri, char *url)
8b0621
 {
8b0621
+    apr_pool_t *p = req->p;
8b0621
+    request_rec *r = req->r;
8b0621
     conn_rec *c = r->connection;
8b0621
-    apr_bucket_alloc_t *bucket_alloc = c->bucket_alloc;
8b0621
-    apr_bucket_brigade *header_brigade;
8b0621
-    apr_bucket_brigade *input_brigade;
8b0621
+    proxy_conn_rec *p_conn = req->backend;
8b0621
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
8b0621
+    apr_bucket_brigade *header_brigade = req->header_brigade;
8b0621
+    apr_bucket_brigade *input_brigade = req->input_brigade;
8b0621
     apr_bucket_brigade *temp_brigade;
8b0621
     apr_bucket *e;
8b0621
     char *buf;
8b0621
     apr_status_t status;
8b0621
-    enum rb_methods {RB_INIT, RB_STREAM_CL, RB_STREAM_CHUNKED, RB_SPOOL_CL};
8b0621
-    enum rb_methods rb_method = RB_INIT;
8b0621
-    char *old_cl_val = NULL;
8b0621
-    char *old_te_val = NULL;
8b0621
     apr_off_t bytes_read = 0;
8b0621
     apr_off_t bytes;
8b0621
     int force10, rv;
8b0621
+    apr_read_type_e block;
8b0621
     conn_rec *origin = p_conn->connection;
8b0621
 
8b0621
     if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) {
8b0621
-        if (r->expecting_100) {
8b0621
+        if (req->expecting_100) {
8b0621
             return HTTP_EXPECTATION_FAILED;
8b0621
         }
8b0621
         force10 = 1;
8b0621
@@ -680,17 +581,14 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
         force10 = 0;
8b0621
     }
8b0621
 
8b0621
-    header_brigade = apr_brigade_create(p, bucket_alloc);
8b0621
     rv = ap_proxy_create_hdrbrgd(p, header_brigade, r, p_conn,
8b0621
-                                 worker, conf, uri, url, server_portstr,
8b0621
-                                 &old_cl_val, &old_te_val);
8b0621
+                                 req->worker, req->sconf,
8b0621
+                                 uri, url, req->server_portstr,
8b0621
+                                 &req->old_cl_val, &req->old_te_val);
8b0621
     if (rv != OK) {
8b0621
         return rv;
8b0621
     }
8b0621
 
8b0621
-    /* We have headers, let's figure out our request body... */
8b0621
-    input_brigade = apr_brigade_create(p, bucket_alloc);
8b0621
-
8b0621
     /* sub-requests never use keepalives, and mustn't pass request bodies.
8b0621
      * Because the new logic looks at input_brigade, we will self-terminate
8b0621
      * input_brigade and jump past all of the request body logic...
8b0621
@@ -703,9 +601,9 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
     if (!r->kept_body && r->main) {
8b0621
         /* XXX: Why DON'T sub-requests use keepalives? */
8b0621
         p_conn->close = 1;
8b0621
-        old_cl_val = NULL;
8b0621
-        old_te_val = NULL;
8b0621
-        rb_method = RB_STREAM_CL;
8b0621
+        req->old_te_val = NULL;
8b0621
+        req->old_cl_val = NULL;
8b0621
+        req->rb_method = RB_STREAM_CL;
8b0621
         e = apr_bucket_eos_create(input_brigade->bucket_alloc);
8b0621
         APR_BRIGADE_INSERT_TAIL(input_brigade, e);
8b0621
         goto skip_body;
8b0621
@@ -719,18 +617,19 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
      * encoding has been done by the extensions' handler, and
8b0621
      * do not modify add_te_chunked's logic
8b0621
      */
8b0621
-    if (old_te_val && strcasecmp(old_te_val, "chunked") != 0) {
8b0621
+    if (req->old_te_val && ap_cstr_casecmp(req->old_te_val, "chunked") != 0) {
8b0621
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01093)
8b0621
-                      "%s Transfer-Encoding is not supported", old_te_val);
8b0621
+                      "%s Transfer-Encoding is not supported",
8b0621
+                      req->old_te_val);
8b0621
         return HTTP_INTERNAL_SERVER_ERROR;
8b0621
     }
8b0621
 
8b0621
-    if (old_cl_val && old_te_val) {
8b0621
+    if (req->old_cl_val && req->old_te_val) {
8b0621
         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01094)
8b0621
                       "client %s (%s) requested Transfer-Encoding "
8b0621
                       "chunked body with Content-Length (C-L ignored)",
8b0621
                       c->client_ip, c->remote_host ? c->remote_host: "");
8b0621
-        old_cl_val = NULL;
8b0621
+        req->old_cl_val = NULL;
8b0621
         origin->keepalive = AP_CONN_CLOSE;
8b0621
         p_conn->close = 1;
8b0621
     }
8b0621
@@ -744,10 +643,19 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
      * reasonable size.
8b0621
      */
8b0621
     temp_brigade = apr_brigade_create(p, bucket_alloc);
8b0621
+    block = req->prefetch_nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ;
8b0621
     do {
8b0621
         status = ap_get_brigade(r->input_filters, temp_brigade,
8b0621
-                                AP_MODE_READBYTES, APR_BLOCK_READ,
8b0621
+                                AP_MODE_READBYTES, block,
8b0621
                                 MAX_MEM_SPOOL - bytes_read);
8b0621
+        /* ap_get_brigade may return success with an empty brigade
8b0621
+         * for a non-blocking read which would block
8b0621
+         */
8b0621
+        if (block == APR_NONBLOCK_READ
8b0621
+            && ((status == APR_SUCCESS && APR_BRIGADE_EMPTY(temp_brigade))
8b0621
+                || APR_STATUS_IS_EAGAIN(status))) {
8b0621
+            break;
8b0621
+        }
8b0621
         if (status != APR_SUCCESS) {
8b0621
             ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01095)
8b0621
                           "prefetch request body failed to %pI (%s)"
8b0621
@@ -785,7 +693,8 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
      * (an arbitrary value.)
8b0621
      */
8b0621
     } while ((bytes_read < MAX_MEM_SPOOL - 80)
8b0621
-              && !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)));
8b0621
+              && !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))
8b0621
+              && !req->prefetch_nonblocking);
8b0621
 
8b0621
     /* Use chunked request body encoding or send a content-length body?
8b0621
      *
8b0621
@@ -822,7 +731,8 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
      * is absent, and the filters are unchanged (the body won't
8b0621
      * be resized by another content filter).
8b0621
      */
8b0621
-    if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
8b0621
+    if (!APR_BRIGADE_EMPTY(input_brigade)
8b0621
+        && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
8b0621
         /* The whole thing fit, so our decision is trivial, use
8b0621
          * the filtered bytes read from the client for the request
8b0621
          * body Content-Length.
8b0621
@@ -830,34 +740,43 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
          * If we expected no body, and read no body, do not set
8b0621
          * the Content-Length.
8b0621
          */
8b0621
-        if (old_cl_val || old_te_val || bytes_read) {
8b0621
-            old_cl_val = apr_off_t_toa(r->pool, bytes_read);
8b0621
+        if (req->old_cl_val || req->old_te_val || bytes_read) {
8b0621
+            req->old_cl_val = apr_off_t_toa(r->pool, bytes_read);
8b0621
+            req->cl_val = bytes_read;
8b0621
         }
8b0621
-        rb_method = RB_STREAM_CL;
8b0621
+        req->rb_method = RB_STREAM_CL;
8b0621
     }
8b0621
-    else if (old_te_val) {
8b0621
+    else if (req->old_te_val) {
8b0621
         if (force10
8b0621
              || (apr_table_get(r->subprocess_env, "proxy-sendcl")
8b0621
                   && !apr_table_get(r->subprocess_env, "proxy-sendchunks")
8b0621
                   && !apr_table_get(r->subprocess_env, "proxy-sendchunked"))) {
8b0621
-            rb_method = RB_SPOOL_CL;
8b0621
+            req->rb_method = RB_SPOOL_CL;
8b0621
         }
8b0621
         else {
8b0621
-            rb_method = RB_STREAM_CHUNKED;
8b0621
+            req->rb_method = RB_STREAM_CHUNKED;
8b0621
         }
8b0621
     }
8b0621
-    else if (old_cl_val) {
8b0621
+    else if (req->old_cl_val) {
8b0621
         if (r->input_filters == r->proto_input_filters) {
8b0621
-            rb_method = RB_STREAM_CL;
8b0621
+            char *endstr;
8b0621
+            status = apr_strtoff(&req->cl_val, req->old_cl_val, &endstr, 10);
8b0621
+            if (status != APR_SUCCESS || *endstr || req->cl_val < 0) {
8b0621
+                ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01085)
8b0621
+                              "could not parse request Content-Length (%s)",
8b0621
+                              req->old_cl_val);
8b0621
+                return HTTP_BAD_REQUEST;
8b0621
+            }
8b0621
+            req->rb_method = RB_STREAM_CL;
8b0621
         }
8b0621
         else if (!force10
8b0621
                   && (apr_table_get(r->subprocess_env, "proxy-sendchunks")
8b0621
                       || apr_table_get(r->subprocess_env, "proxy-sendchunked"))
8b0621
                   && !apr_table_get(r->subprocess_env, "proxy-sendcl")) {
8b0621
-            rb_method = RB_STREAM_CHUNKED;
8b0621
+            req->rb_method = RB_STREAM_CHUNKED;
8b0621
         }
8b0621
         else {
8b0621
-            rb_method = RB_SPOOL_CL;
8b0621
+            req->rb_method = RB_SPOOL_CL;
8b0621
         }
8b0621
     }
8b0621
     else {
8b0621
@@ -865,7 +784,31 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
8b0621
          * requests, and has the behavior that it will not add any C-L
8b0621
          * when the old_cl_val is NULL.
8b0621
          */
8b0621
-        rb_method = RB_SPOOL_CL;
8b0621
+        req->rb_method = RB_SPOOL_CL;
8b0621
+    }
8b0621
+
8b0621
+    switch (req->rb_method) {
8b0621
+    case RB_STREAM_CHUNKED:
8b0621
+        add_te_chunked(req->p, bucket_alloc, header_brigade);
8b0621
+        break;
8b0621
+
8b0621
+    case RB_STREAM_CL:
8b0621
+        if (req->old_cl_val) {
8b0621
+            add_cl(req->p, bucket_alloc, header_brigade, req->old_cl_val);
8b0621
+        }
8b0621
+        break;
8b0621
+
8b0621
+    default: /* => RB_SPOOL_CL */
8b0621
+        /* If we have to spool the body, do it now, before connecting or
8b0621
+         * reusing the backend connection.
8b0621
+         */
8b0621
+        rv = spool_reqbody_cl(req, &bytes);
8b0621
+        if (rv != OK) {
8b0621
+            return rv;
8b0621
+        }
8b0621
+        if (bytes || req->old_te_val || req->old_cl_val) {
8b0621
+            add_cl(p, bucket_alloc, header_brigade, apr_off_t_toa(p, bytes));
8b0621
+        }
8b0621
     }
8b0621
 
8b0621
 /* Yes I hate gotos.  This is the subrequest shortcut */
8b0621
@@ -886,23 +829,44 @@ skip_body:
8b0621
         e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
8b0621
         APR_BRIGADE_INSERT_TAIL(header_brigade, e);
8b0621
     }
8b0621
+    terminate_headers(bucket_alloc, header_brigade);
8b0621
 
8b0621
-    /* send the request body, if any. */
8b0621
-    switch(rb_method) {
8b0621
-    case RB_STREAM_CHUNKED:
8b0621
-        rv = stream_reqbody_chunked(p, r, p_conn, origin, header_brigade,
8b0621
-                                        input_brigade);
8b0621
-        break;
8b0621
+    return OK;
8b0621
+}
8b0621
+
8b0621
+static int ap_proxy_http_request(proxy_http_req_t *req)
8b0621
+{
8b0621
+    int rv;
8b0621
+    request_rec *r = req->r;
8b0621
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
8b0621
+    apr_bucket_brigade *header_brigade = req->header_brigade;
8b0621
+    apr_bucket_brigade *input_brigade = req->input_brigade;
8b0621
+
8b0621
+    /* send the request header/body, if any. */
8b0621
+    switch (req->rb_method) {
8b0621
     case RB_STREAM_CL:
8b0621
-        rv = stream_reqbody_cl(p, r, p_conn, origin, header_brigade,
8b0621
-                                   input_brigade, old_cl_val);
8b0621
+    case RB_STREAM_CHUNKED:
8b0621
+        if (req->do_100_continue) {
8b0621
+            rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend,
8b0621
+                                       req->origin, header_brigade, 1);
8b0621
+        }
8b0621
+        else {
8b0621
+            rv = stream_reqbody(req, req->rb_method);
8b0621
+        }
8b0621
         break;
8b0621
+
8b0621
     case RB_SPOOL_CL:
8b0621
-        rv = spool_reqbody_cl(p, r, p_conn, origin, header_brigade,
8b0621
-                                  input_brigade, (old_cl_val != NULL)
8b0621
-                                              || (old_te_val != NULL)
8b0621
-                                              || (bytes_read > 0));
8b0621
+        /* Prefetch has built the header and spooled the whole body;
8b0621
+         * if we don't expect 100-continue we can flush both all at once,
8b0621
+         * otherwise flush the header only.
8b0621
+         */
8b0621
+        if (!req->do_100_continue) {
8b0621
+            APR_BRIGADE_CONCAT(header_brigade, input_brigade);
8b0621
+        }
8b0621
+        rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend,
8b0621
+                                   req->origin, header_brigade, 1);
8b0621
         break;
8b0621
+
8b0621
     default:
8b0621
         /* shouldn't be possible */
8b0621
         rv = HTTP_INTERNAL_SERVER_ERROR;
8b0621
@@ -910,10 +874,12 @@ skip_body:
8b0621
     }
8b0621
 
8b0621
     if (rv != OK) {
8b0621
+        conn_rec *c = r->connection;
8b0621
         /* apr_status_t value has been logged in lower level method */
8b0621
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01097)
8b0621
                       "pass request body failed to %pI (%s) from %s (%s)",
8b0621
-                      p_conn->addr, p_conn->hostname ? p_conn->hostname: "",
8b0621
+                      req->backend->addr,
8b0621
+                      req->backend->hostname ? req->backend->hostname: "",
8b0621
                       c->client_ip, c->remote_host ? c->remote_host: "");
8b0621
         return rv;
8b0621
     }
8b0621
@@ -1189,12 +1155,16 @@ static int add_trailers(void *data, const char *key, const char *val)
8b0621
 }
8b0621
 
8b0621
 static
8b0621
-apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
-                                            proxy_conn_rec **backend_ptr,
8b0621
-                                            proxy_worker *worker,
8b0621
-                                            proxy_server_conf *conf,
8b0621
-                                            char *server_portstr) {
8b0621
+int ap_proxy_http_process_response(proxy_http_req_t *req)
8b0621
+{
8b0621
+    apr_pool_t *p = req->p;
8b0621
+    request_rec *r = req->r;
8b0621
     conn_rec *c = r->connection;
8b0621
+    proxy_worker *worker = req->worker;
8b0621
+    proxy_conn_rec *backend = req->backend;
8b0621
+    conn_rec *origin = req->origin;
8b0621
+    int do_100_continue = req->do_100_continue;
8b0621
+
8b0621
     char *buffer;
8b0621
     char fixed_buffer[HUGE_STRING_LEN];
8b0621
     const char *buf;
8b0621
@@ -1217,19 +1187,11 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
     int proxy_status = OK;
8b0621
     const char *original_status_line = r->status_line;
8b0621
     const char *proxy_status_line = NULL;
8b0621
-    proxy_conn_rec *backend = *backend_ptr;
8b0621
-    conn_rec *origin = backend->connection;
8b0621
     apr_interval_time_t old_timeout = 0;
8b0621
     proxy_dir_conf *dconf;
8b0621
-    int do_100_continue;
8b0621
 
8b0621
     dconf = ap_get_module_config(r->per_dir_config, &proxy_module);
8b0621
 
8b0621
-    do_100_continue = (worker->s->ping_timeout_set
8b0621
-                       && ap_request_has_body(r)
8b0621
-                       && (PROXYREQ_REVERSE == r->proxyreq)
8b0621
-                       && !(apr_table_get(r->subprocess_env, "force-proxy-request-1.0")));
8b0621
-
8b0621
     bb = apr_brigade_create(p, c->bucket_alloc);
8b0621
     pass_bb = apr_brigade_create(p, c->bucket_alloc);
8b0621
 
8b0621
@@ -1248,7 +1210,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
     }
8b0621
 
8b0621
     /* Setup for 100-Continue timeout if appropriate */
8b0621
-    if (do_100_continue) {
8b0621
+    if (do_100_continue && worker->s->ping_timeout_set) {
8b0621
         apr_socket_timeout_get(backend->sock, &old_timeout);
8b0621
         if (worker->s->ping_timeout != old_timeout) {
8b0621
             apr_status_t rc;
8b0621
@@ -1273,6 +1235,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
                    origin->local_addr->port));
8b0621
     do {
8b0621
         apr_status_t rc;
8b0621
+        int major = 0, minor = 0;
8b0621
+        int toclose = 0;
8b0621
 
8b0621
         apr_brigade_cleanup(bb);
8b0621
 
8b0621
@@ -1360,9 +1324,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
          * This is buggy if we ever see an HTTP/1.10
8b0621
          */
8b0621
         if (apr_date_checkmask(buffer, "HTTP/#.# ###*")) {
8b0621
-            int major, minor;
8b0621
-            int toclose;
8b0621
-
8b0621
             major = buffer[5] - '0';
8b0621
             minor = buffer[7] - '0';
8b0621
 
8b0621
@@ -1412,8 +1373,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
                          "Set-Cookie", NULL);
8b0621
 
8b0621
             /* shove the headers direct into r->headers_out */
8b0621
-            ap_proxy_read_headers(r, backend->r, buffer, response_field_size, origin,
8b0621
-                                  &pread_len);
8b0621
+            ap_proxy_read_headers(r, backend->r, buffer, response_field_size,
8b0621
+                                  origin, &pread_len);
8b0621
 
8b0621
             if (r->headers_out == NULL) {
8b0621
                 ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01106)
8b0621
@@ -1491,7 +1452,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
             r->headers_out = ap_proxy_clean_warnings(p, r->headers_out);
8b0621
 
8b0621
             /* handle Via header in response */
8b0621
-            if (conf->viaopt != via_off && conf->viaopt != via_block) {
8b0621
+            if (req->sconf->viaopt != via_off
8b0621
+                    && req->sconf->viaopt != via_block) {
8b0621
                 const char *server_name = ap_get_server_name(r);
8b0621
                 /* If USE_CANONICAL_NAME_OFF was configured for the proxy virtual host,
8b0621
                  * then the server name returned by ap_get_server_name() is the
8b0621
@@ -1502,18 +1464,18 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
                     server_name = r->server->server_hostname;
8b0621
                 /* create a "Via:" response header entry and merge it */
8b0621
                 apr_table_addn(r->headers_out, "Via",
8b0621
-                               (conf->viaopt == via_full)
8b0621
+                               (req->sconf->viaopt == via_full)
8b0621
                                      ? apr_psprintf(p, "%d.%d %s%s (%s)",
8b0621
                                            HTTP_VERSION_MAJOR(r->proto_num),
8b0621
                                            HTTP_VERSION_MINOR(r->proto_num),
8b0621
                                            server_name,
8b0621
-                                           server_portstr,
8b0621
+                                           req->server_portstr,
8b0621
                                            AP_SERVER_BASEVERSION)
8b0621
                                      : apr_psprintf(p, "%d.%d %s%s",
8b0621
                                            HTTP_VERSION_MAJOR(r->proto_num),
8b0621
                                            HTTP_VERSION_MINOR(r->proto_num),
8b0621
                                            server_name,
8b0621
-                                           server_portstr)
8b0621
+                                           req->server_portstr)
8b0621
                 );
8b0621
             }
8b0621
 
8b0621
@@ -1531,18 +1493,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
         }
8b0621
 
8b0621
         if (ap_is_HTTP_INFO(proxy_status)) {
8b0621
-            interim_response++;
8b0621
-            /* Reset to old timeout iff we've adjusted it */
8b0621
-            if (do_100_continue
8b0621
-                && (r->status == HTTP_CONTINUE)
8b0621
-                && (worker->s->ping_timeout != old_timeout)) {
8b0621
-                    apr_socket_timeout_set(backend->sock, old_timeout);
8b0621
-            }
8b0621
-        }
8b0621
-        else {
8b0621
-            interim_response = 0;
8b0621
-        }
8b0621
-        if (interim_response) {
8b0621
             /* RFC2616 tells us to forward this.
8b0621
              *
8b0621
              * OTOH, an interim response here may mean the backend
8b0621
@@ -1563,7 +1513,13 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
8b0621
                           "HTTP: received interim %d response", r->status);
8b0621
             if (!policy
8b0621
-                    || (!strcasecmp(policy, "RFC") && ((r->expecting_100 = 1)))) {
8b0621
+                    || (!strcasecmp(policy, "RFC")
8b0621
+                        && (proxy_status != HTTP_CONTINUE
8b0621
+                            || (req->expecting_100 = 1)))) {
8b0621
+                if (proxy_status == HTTP_CONTINUE) {
8b0621
+                    r->expecting_100 = req->expecting_100;
8b0621
+                    req->expecting_100 = 0;
8b0621
+                }
8b0621
                 ap_send_interim_response(r, 1);
8b0621
             }
8b0621
             /* FIXME: refine this to be able to specify per-response-status
8b0621
@@ -1573,7 +1529,106 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
                 ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01108)
8b0621
                               "undefined proxy interim response policy");
8b0621
             }
8b0621
+            interim_response++;
8b0621
         }
8b0621
+        else {
8b0621
+            interim_response = 0;
8b0621
+        }
8b0621
+
8b0621
+        /* If we still do 100-continue (end-to-end or ping), either the
8b0621
+         * current response is the expected "100 Continue" and we are done
8b0621
+         * with this mode, or this is another interim response and we'll wait
8b0621
+         * for the next one, or this is a final response and hence the backend
8b0621
+         * did not honor our expectation.
8b0621
+         */
8b0621
+        if (do_100_continue && (!interim_response
8b0621
+                                || proxy_status == HTTP_CONTINUE)) {
8b0621
+            /* RFC 7231 - Section 5.1.1 - Expect - Requirement for servers
8b0621
+             *   A server that responds with a final status code before
8b0621
+             *   reading the entire message body SHOULD indicate in that
8b0621
+             *   response whether it intends to close the connection or
8b0621
+             *   continue reading and discarding the request message.
8b0621
+             *
8b0621
+             * So, if this response is not an interim 100 Continue, we can
8b0621
+             * avoid sending the request body if the backend responded with
8b0621
+             * "Connection: close" or HTTP < 1.1, and either let the core
8b0621
+             * discard it or the caller try another balancer member with the
8b0621
+             * same body (given status 503, though not implemented yet).
8b0621
+             */
8b0621
+            int do_send_body = (proxy_status == HTTP_CONTINUE
8b0621
+                                || (!toclose && major > 0 && minor > 0));
8b0621
+
8b0621
+            /* Reset to old timeout iff we've adjusted it. */
8b0621
+            if (worker->s->ping_timeout_set) {
8b0621
+                apr_socket_timeout_set(backend->sock, old_timeout);
8b0621
+            }
8b0621
+
8b0621
+            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(10153)
8b0621
+                          "HTTP: %s100 continue sent by %pI (%s): "
8b0621
+                          "%ssending body (response: HTTP/%i.%i %s)",
8b0621
+                          proxy_status != HTTP_CONTINUE ? "no " : "",
8b0621
+                          backend->addr,
8b0621
+                          backend->hostname ? backend->hostname : "",
8b0621
+                          do_send_body ? "" : "not ",
8b0621
+                          major, minor, proxy_status_line);
8b0621
+
8b0621
+            if (do_send_body) {
8b0621
+                int status;
8b0621
+
8b0621
+                /* Send the request body (fully). */
8b0621
+                switch(req->rb_method) {
8b0621
+                case RB_STREAM_CL:
8b0621
+                case RB_STREAM_CHUNKED:
8b0621
+                    status = stream_reqbody(req, req->rb_method);
8b0621
+                    break;
8b0621
+                case RB_SPOOL_CL:
8b0621
+                    /* Prefetch has spooled the whole body, flush it. */
8b0621
+                    status = ap_proxy_pass_brigade(req->bucket_alloc, r,
8b0621
+                                                   backend, origin,
8b0621
+                                                   req->input_brigade, 1);
8b0621
+                    break;
8b0621
+                default:
8b0621
+                    /* Shouldn't happen */
8b0621
+                    status = HTTP_INTERNAL_SERVER_ERROR;
8b0621
+                    break;
8b0621
+                }
8b0621
+                if (status != OK) {
8b0621
+                    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
8b0621
+                            APLOGNO(10154) "pass request body failed "
8b0621
+                            "to %pI (%s) from %s (%s) with status %i",
8b0621
+                            backend->addr,
8b0621
+                            backend->hostname ? backend->hostname : "",
8b0621
+                            c->client_ip,
8b0621
+                            c->remote_host ? c->remote_host : "",
8b0621
+                            status);
8b0621
+                    backend->close = 1;
8b0621
+                    return status;
8b0621
+                }
8b0621
+            }
8b0621
+            else {
8b0621
+                /* If we don't read the client connection any further, since
8b0621
+                 * there are pending data it should be "Connection: close"d to
8b0621
+                 * prevent reuse. We don't exactly c->keepalive = AP_CONN_CLOSE
8b0621
+                 * here though, because error_override or a potential retry on
8b0621
+                 * another backend could finally read that data and finalize
8b0621
+                 * the request processing, making keep-alive possible. So what
8b0621
+                 * we do is restoring r->expecting_100 for ap_set_keepalive()
8b0621
+                 * to do the right thing according to the final response and
8b0621
+                 * any later update of r->expecting_100.
8b0621
+                 */
8b0621
+                r->expecting_100 = req->expecting_100;
8b0621
+                req->expecting_100 = 0;
8b0621
+            }
8b0621
+
8b0621
+            /* Once only! */
8b0621
+            do_100_continue = 0;
8b0621
+        }
8b0621
+
8b0621
+        if (interim_response) {
8b0621
+            /* Already forwarded above, read next response */
8b0621
+            continue;
8b0621
+        }
8b0621
+
8b0621
         /* Moved the fixups of Date headers and those affected by
8b0621
          * ProxyPassReverse/etc from here to ap_proxy_read_headers
8b0621
          */
8b0621
@@ -1648,7 +1703,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
 
8b0621
         /* send body - but only if a body is expected */
8b0621
         if ((!r->header_only) &&                   /* not HEAD request */
8b0621
-            !interim_response &&                   /* not any 1xx response */
8b0621
             (proxy_status != HTTP_NO_CONTENT) &&      /* not 204 */
8b0621
             (proxy_status != HTTP_NOT_MODIFIED)) {    /* not 304 */
8b0621
 
8b0621
@@ -1697,7 +1751,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
 
8b0621
                     rv = ap_get_brigade(backend->r->input_filters, bb,
8b0621
                                         AP_MODE_READBYTES, mode,
8b0621
-                                        conf->io_buffer_size);
8b0621
+                                        req->sconf->io_buffer_size);
8b0621
 
8b0621
                     /* ap_get_brigade will return success with an empty brigade
8b0621
                      * for a non-blocking read which would block: */
8b0621
@@ -1789,7 +1843,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
                         ap_proxy_release_connection(backend->worker->s->scheme,
8b0621
                                 backend, r->server);
8b0621
                         /* Ensure that the backend is not reused */
8b0621
-                        *backend_ptr = NULL;
8b0621
+                        req->backend = NULL;
8b0621
 
8b0621
                     }
8b0621
 
8b0621
@@ -1798,12 +1852,13 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
                         || c->aborted) {
8b0621
                         /* Ack! Phbtt! Die! User aborted! */
8b0621
                         /* Only close backend if we haven't got all from the
8b0621
-                         * backend. Furthermore if *backend_ptr is NULL it is no
8b0621
+                         * backend. Furthermore if req->backend is NULL it is no
8b0621
                          * longer safe to fiddle around with backend as it might
8b0621
                          * be already in use by another thread.
8b0621
                          */
8b0621
-                        if (*backend_ptr) {
8b0621
-                            backend->close = 1;  /* this causes socket close below */
8b0621
+                        if (req->backend) {
8b0621
+                            /* this causes socket close below */
8b0621
+                            req->backend->close = 1;
8b0621
                         }
8b0621
                         finish = TRUE;
8b0621
                     }
8b0621
@@ -1816,7 +1871,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
             }
8b0621
             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, "end body send");
8b0621
         }
8b0621
-        else if (!interim_response) {
8b0621
+        else {
8b0621
             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, "header only");
8b0621
 
8b0621
             /* make sure we release the backend connection as soon
8b0621
@@ -1826,7 +1881,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
8b0621
              */
8b0621
             ap_proxy_release_connection(backend->worker->s->scheme,
8b0621
                     backend, r->server);
8b0621
-            *backend_ptr = NULL;
8b0621
+            req->backend = NULL;
8b0621
 
8b0621
             /* Pass EOS bucket down the filter chain. */
8b0621
             e = apr_bucket_eos_create(c->bucket_alloc);
8b0621
@@ -1880,14 +1935,17 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
8b0621
                               apr_port_t proxyport)
8b0621
 {
8b0621
     int status;
8b0621
-    char server_portstr[32];
8b0621
     char *scheme;
8b0621
     const char *proxy_function;
8b0621
     const char *u;
8b0621
+    proxy_http_req_t *req = NULL;
8b0621
     proxy_conn_rec *backend = NULL;
8b0621
     int is_ssl = 0;
8b0621
     conn_rec *c = r->connection;
8b0621
+    proxy_dir_conf *dconf;
8b0621
     int retry = 0;
8b0621
+    char *locurl = url;
8b0621
+    int toclose = 0;
8b0621
     /*
8b0621
      * Use a shorter-lived pool to reduce memory usage
8b0621
      * and avoid a memory leak
8b0621
@@ -1928,14 +1986,47 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
8b0621
     }
8b0621
     ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "HTTP: serving URL %s", url);
8b0621
 
8b0621
-
8b0621
     /* create space for state information */
8b0621
     if ((status = ap_proxy_acquire_connection(proxy_function, &backend,
8b0621
-                                              worker, r->server)) != OK)
8b0621
-        goto cleanup;
8b0621
+                                              worker, r->server)) != OK) {
8b0621
+        return status;
8b0621
+    }
8b0621
 
8b0621
     backend->is_ssl = is_ssl;
8b0621
 
8b0621
+    req = apr_pcalloc(p, sizeof(*req));
8b0621
+    req->p = p;
8b0621
+    req->r = r;
8b0621
+    req->sconf = conf;
8b0621
+    req->worker = worker;
8b0621
+    req->backend = backend;
8b0621
+    req->bucket_alloc = c->bucket_alloc;
8b0621
+    req->rb_method = RB_INIT;
8b0621
+
8b0621
+    dconf = ap_get_module_config(r->per_dir_config, &proxy_module);
8b0621
+
8b0621
+    /* Should we handle end-to-end or ping 100-continue? */
8b0621
+    if ((r->expecting_100 && dconf->forward_100_continue)
8b0621
+            || PROXY_DO_100_CONTINUE(worker, r)) {
8b0621
+        /* We need to reset r->expecting_100 or prefetching will cause
8b0621
+         * ap_http_filter() to send "100 Continue" response by itself. So
8b0621
+         * we'll use req->expecting_100 in mod_proxy_http to determine whether
8b0621
+         * the client should be forwarded "100 continue", and r->expecting_100
8b0621
+         * will be restored at the end of the function with the actual value of
8b0621
+         * req->expecting_100 (i.e. cleared only if mod_proxy_http sent the
8b0621
+         * "100 Continue" according to its policy).
8b0621
+         */
8b0621
+        req->do_100_continue = req->prefetch_nonblocking = 1;
8b0621
+        req->expecting_100 = r->expecting_100;
8b0621
+        r->expecting_100 = 0;
8b0621
+    }
8b0621
+    /* Should we block while prefetching the body or try nonblocking and flush
8b0621
+     * data to the backend ASAP?
8b0621
+     */
8b0621
+    else if (apr_table_get(r->subprocess_env, "proxy-prefetch-nonblocking")) {
8b0621
+        req->prefetch_nonblocking = 1;
8b0621
+    }
8b0621
+
8b0621
     /*
8b0621
      * In the case that we are handling a reverse proxy connection and this
8b0621
      * is not a request that is coming over an already kept alive connection
8b0621
@@ -1949,15 +2040,53 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
8b0621
         backend->close = 1;
8b0621
     }
8b0621
 
8b0621
+    /* Step One: Determine Who To Connect To */
8b0621
+    if ((status = ap_proxy_determine_connection(p, r, conf, worker, backend,
8b0621
+                                            uri, &locurl, proxyname,
8b0621
+                                            proxyport, req->server_portstr,
8b0621
+                                            sizeof(req->server_portstr))))
8b0621
+        goto cleanup;
8b0621
+
8b0621
+    /* Prefetch (nonlocking) the request body so to increase the chance to get
8b0621
+     * the whole (or enough) body and determine Content-Length vs chunked or
8b0621
+     * spooled. By doing this before connecting or reusing the backend, we want
8b0621
+     * to minimize the delay between this connection is considered alive and
8b0621
+     * the first bytes sent (should the client's link be slow or some input
8b0621
+     * filter retain the data). This is a best effort to prevent the backend
8b0621
+     * from closing (from under us) what it thinks is an idle connection, hence
8b0621
+     * to reduce to the minimum the unavoidable local is_socket_connected() vs
8b0621
+     * remote keepalive race condition.
8b0621
+     */
8b0621
+    req->input_brigade = apr_brigade_create(p, req->bucket_alloc);
8b0621
+    req->header_brigade = apr_brigade_create(p, req->bucket_alloc);
8b0621
+    if ((status = ap_proxy_http_prefetch(req, uri, locurl)) != OK)
8b0621
+        goto cleanup;
8b0621
+
8b0621
+    /* We need to reset backend->close now, since ap_proxy_http_prefetch() set
8b0621
+     * it to disable the reuse of the connection *after* this request (no keep-
8b0621
+     * alive), not to close any reusable connection before this request. However
8b0621
+     * assure what is expected later by using a local flag and do the right thing
8b0621
+     * when ap_proxy_connect_backend() below provides the connection to close.
8b0621
+     */
8b0621
+    toclose = backend->close;
8b0621
+    backend->close = 0;
8b0621
+
8b0621
     while (retry < 2) {
8b0621
-        char *locurl = url;
8b0621
+        if (retry) {
8b0621
+            char *newurl = url;
8b0621
 
8b0621
-        /* Step One: Determine Who To Connect To */
8b0621
-        if ((status = ap_proxy_determine_connection(p, r, conf, worker, backend,
8b0621
-                                                uri, &locurl, proxyname,
8b0621
-                                                proxyport, server_portstr,
8b0621
-                                                sizeof(server_portstr))) != OK)
8b0621
-            break;
8b0621
+            /* Step One (again): (Re)Determine Who To Connect To */
8b0621
+            if ((status = ap_proxy_determine_connection(p, r, conf, worker,
8b0621
+                            backend, uri, &newurl, proxyname, proxyport,
8b0621
+                            req->server_portstr, sizeof(req->server_portstr))))
8b0621
+                break;
8b0621
+
8b0621
+            /* The code assumes locurl is not changed during the loop, or
8b0621
+             * ap_proxy_http_prefetch() would have to be called every time,
8b0621
+             * and header_brigade be changed accordingly...
8b0621
+             */
8b0621
+            AP_DEBUG_ASSERT(strcmp(newurl, locurl) == 0);
8b0621
+        }
8b0621
 
8b0621
         /* Step Two: Make the Connection */
8b0621
         if (ap_proxy_check_connection(proxy_function, backend, r->server, 1,
8b0621
@@ -1972,54 +2101,64 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
8b0621
         }
8b0621
 
8b0621
         /* Step Three: Create conn_rec */
8b0621
-        if (!backend->connection) {
8b0621
-            if ((status = ap_proxy_connection_create_ex(proxy_function,
8b0621
-                                                        backend, r)) != OK)
8b0621
-                break;
8b0621
-            /*
8b0621
-             * On SSL connections set a note on the connection what CN is
8b0621
-             * requested, such that mod_ssl can check if it is requested to do
8b0621
-             * so.
8b0621
-             */
8b0621
-            if (backend->ssl_hostname) {
8b0621
-                apr_table_setn(backend->connection->notes,
8b0621
-                               "proxy-request-hostname",
8b0621
-                               backend->ssl_hostname);
8b0621
-            }
8b0621
+        if ((status = ap_proxy_connection_create_ex(proxy_function,
8b0621
+                                                    backend, r)) != OK)
8b0621
+            break;
8b0621
+        req->origin = backend->connection;
8b0621
+
8b0621
+        /* Don't recycle the connection if prefetch (above) told not to do so */
8b0621
+        if (toclose) {
8b0621
+            backend->close = 1;
8b0621
+            req->origin->keepalive = AP_CONN_CLOSE;
8b0621
+        }
8b0621
+
8b0621
+        /*
8b0621
+         * On SSL connections set a note on the connection what CN is
8b0621
+         * requested, such that mod_ssl can check if it is requested to do
8b0621
+         * so.
8b0621
+         *
8b0621
+         * https://github.com/apache/httpd/commit/7d272e2628b4ae05f68cdc74b070707250896a34
8b0621
+         */
8b0621
+        if (backend->ssl_hostname) {
8b0621
+            apr_table_setn(backend->connection->notes,
8b0621
+                           "proxy-request-hostname",
8b0621
+                           backend->ssl_hostname);
8b0621
         }
8b0621
 
8b0621
         /* Step Four: Send the Request
8b0621
          * On the off-chance that we forced a 100-Continue as a
8b0621
          * kinda HTTP ping test, allow for retries
8b0621
          */
8b0621
-        if ((status = ap_proxy_http_request(p, r, backend, worker,
8b0621
-                                        conf, uri, locurl, server_portstr)) != OK) {
8b0621
-            if ((status == HTTP_SERVICE_UNAVAILABLE) && worker->s->ping_timeout_set) {
8b0621
-                backend->close = 1;
8b0621
+        status = ap_proxy_http_request(req);
8b0621
+        if (status != OK) {
8b0621
+            if (req->do_100_continue && status == HTTP_SERVICE_UNAVAILABLE) {
8b0621
                 ap_log_rerror(APLOG_MARK, APLOG_INFO, status, r, APLOGNO(01115)
8b0621
                               "HTTP: 100-Continue failed to %pI (%s)",
8b0621
                               worker->cp->addr, worker->s->hostname_ex);
8b0621
+                backend->close = 1;
8b0621
                 retry++;
8b0621
                 continue;
8b0621
-            } else {
8b0621
-                break;
8b0621
-            }
8b0621
+            } 
8b0621
 
8b0621
+            break;
8b0621
         }
8b0621
 
8b0621
         /* Step Five: Receive the Response... Fall thru to cleanup */
8b0621
-        status = ap_proxy_http_process_response(p, r, &backend, worker,
8b0621
-                                                conf, server_portstr);
8b0621
+        status = ap_proxy_http_process_response(req);
8b0621
 
8b0621
         break;
8b0621
     }
8b0621
 
8b0621
     /* Step Six: Clean Up */
8b0621
 cleanup:
8b0621
-    if (backend) {
8b0621
+    if (req->backend) {
8b0621
         if (status != OK)
8b0621
-            backend->close = 1;
8b0621
-        ap_proxy_http_cleanup(proxy_function, r, backend);
8b0621
+            req->backend->close = 1;
8b0621
+        ap_proxy_http_cleanup(proxy_function, r, req->backend);
8b0621
+    }
8b0621
+    if (req->expecting_100) {
8b0621
+        /* Restore r->expecting_100 if we didn't touch it */
8b0621
+        r->expecting_100 = req->expecting_100;
8b0621
     }
8b0621
     return status;
8b0621
 }
8b0621
diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c
8b0621
index c5d4f8e..e1253e4 100644
8b0621
--- a/modules/proxy/mod_proxy_uwsgi.c
8b0621
+++ b/modules/proxy/mod_proxy_uwsgi.c
8b0621
@@ -509,12 +509,11 @@ static int uwsgi_handler(request_rec *r, proxy_worker * worker,
8b0621
     }
8b0621
 
8b0621
     /* Step Three: Create conn_rec */
8b0621
-    if (!backend->connection) {
8b0621
-        if ((status = ap_proxy_connection_create(UWSGI_SCHEME, backend,
8b0621
-                                                 r->connection,
8b0621
-                                                 r->server)) != OK)
8b0621
-            goto cleanup;
8b0621
-    }
8b0621
+    if ((status = ap_proxy_connection_create(UWSGI_SCHEME, backend,
8b0621
+                                             r->connection,
8b0621
+                                             r->server)) != OK)
8b0621
+        goto cleanup;
8b0621
+
8b0621
 
8b0621
     /* Step Four: Process the Request */
8b0621
     if (((status = ap_setup_client_block(r, REQUEST_CHUNKED_ERROR)) != OK)
8b0621
diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c
8b0621
index 9dda010..4aadbab 100644
8b0621
--- a/modules/proxy/mod_proxy_wstunnel.c
8b0621
+++ b/modules/proxy/mod_proxy_wstunnel.c
8b0621
@@ -284,8 +284,8 @@ static int proxy_wstunnel_handler(request_rec *r, proxy_worker *worker,
8b0621
     char server_portstr[32];
8b0621
     proxy_conn_rec *backend = NULL;
8b0621
     char *scheme;
8b0621
-    int retry;
8b0621
     apr_pool_t *p = r->pool;
8b0621
+    char *locurl = url;
8b0621
     apr_uri_t *uri;
8b0621
     int is_ssl = 0;
8b0621
     const char *upgrade_method = *worker->s->upgrade ? worker->s->upgrade : "WebSocket";
8b0621
@@ -318,59 +318,51 @@ static int proxy_wstunnel_handler(request_rec *r, proxy_worker *worker,
8b0621
     ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02451) "serving URL %s", url);
8b0621
 
8b0621
     /* create space for state information */
8b0621
-    status = ap_proxy_acquire_connection(scheme, &backend, worker,
8b0621
-                                         r->server);
8b0621
+    status = ap_proxy_acquire_connection(scheme, &backend, worker, r->server);
8b0621
     if (status != OK) {
8b0621
-        if (backend) {
8b0621
-            backend->close = 1;
8b0621
-            ap_proxy_release_connection(scheme, backend, r->server);
8b0621
-        }
8b0621
-        return status;
8b0621
+        goto cleanup;
8b0621
     }
8b0621
 
8b0621
     backend->is_ssl = is_ssl;
8b0621
     backend->close = 0;
8b0621
 
8b0621
-    retry = 0;
8b0621
-    while (retry < 2) {
8b0621
-        char *locurl = url;
8b0621
-        /* Step One: Determine Who To Connect To */
8b0621
-        status = ap_proxy_determine_connection(p, r, conf, worker, backend,
8b0621
-                                               uri, &locurl, proxyname, proxyport,
8b0621
-                                               server_portstr,
8b0621
-                                               sizeof(server_portstr));
8b0621
-
8b0621
-        if (status != OK)
8b0621
-            break;
8b0621
-
8b0621
-        /* Step Two: Make the Connection */
8b0621
-        if (ap_proxy_connect_backend(scheme, backend, worker, r->server)) {
8b0621
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02452)
8b0621
-                          "failed to make connection to backend: %s",
8b0621
-                          backend->hostname);
8b0621
-            status = HTTP_SERVICE_UNAVAILABLE;
8b0621
-            break;
8b0621
-        }
8b0621
-
8b0621
-        /* Step Three: Create conn_rec */
8b0621
-        if (!backend->connection) {
8b0621
-            status = ap_proxy_connection_create_ex(scheme, backend, r);
8b0621
-            if (status  != OK) {
8b0621
-                break;
8b0621
-            }
8b0621
-        }
8b0621
-
8b0621
-        backend->close = 1; /* must be after ap_proxy_determine_connection */
8b0621
-
8b0621
+    /* Step One: Determine Who To Connect To */
8b0621
+    status = ap_proxy_determine_connection(p, r, conf, worker, backend,
8b0621
+                                           uri, &locurl, proxyname, proxyport,
8b0621
+                                           server_portstr,
8b0621
+                                           sizeof(server_portstr));
8b0621
+    
8b0621
+    if (status != OK) {
8b0621
+        goto cleanup;
8b0621
+    }
8b0621
+    
8b0621
+    /* Step Two: Make the Connection */
8b0621
+    if (ap_proxy_connect_backend(scheme, backend, worker, r->server)) {
8b0621
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02452)
8b0621
+                      "failed to make connection to backend: %s",
8b0621
+                      backend->hostname);
8b0621
+        status = HTTP_SERVICE_UNAVAILABLE;
8b0621
+        goto cleanup;
8b0621
+    }
8b0621
 
8b0621
-        /* Step Three: Process the Request */
8b0621
-        status = proxy_wstunnel_request(p, r, backend, worker, conf, uri, locurl,
8b0621
-                                      server_portstr);
8b0621
-        break;
8b0621
+    /* Step Three: Create conn_rec */
8b0621
+    /* keep it because of */
8b0621
+    /* https://github.com/apache/httpd/commit/313d5ee40f390da1a6ee2c2752864ad3aad0a1c3 */
8b0621
+    status = ap_proxy_connection_create_ex(scheme, backend, r);
8b0621
+    if (status != OK) {
8b0621
+        goto cleanup;
8b0621
     }
8b0621
+    
8b0621
+    /* Step Four: Process the Request */
8b0621
+    status = proxy_wstunnel_request(p, r, backend, worker, conf, uri, locurl,
8b0621
+                                  server_portstr);
8b0621
 
8b0621
+cleanup:
8b0621
     /* Do not close the socket */
8b0621
-    ap_proxy_release_connection(scheme, backend, r->server);
8b0621
+    if (backend) {
8b0621
+        backend->close = 1;
8b0621
+        ap_proxy_release_connection(scheme, backend, r->server);
8b0621
+    }
8b0621
     return status;
8b0621
 }
8b0621
 
8b0621
diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
8b0621
index 0bbfa59..0759dac 100644
8b0621
--- a/modules/proxy/proxy_util.c
8b0621
+++ b/modules/proxy/proxy_util.c
8b0621
@@ -3573,10 +3573,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
8b0621
      * To be compliant, we only use 100-Continue for requests with bodies.
8b0621
      * We also make sure we won't be talking HTTP/1.0 as well.
8b0621
      */
8b0621
-    do_100_continue = (worker->s->ping_timeout_set
8b0621
-                       && ap_request_has_body(r)
8b0621
-                       && (PROXYREQ_REVERSE == r->proxyreq)
8b0621
-                       && !(apr_table_get(r->subprocess_env, "force-proxy-request-1.0")));
8b0621
+    do_100_continue = PROXY_DO_100_CONTINUE(worker, r);
8b0621
 
8b0621
     if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) {
8b0621
         /*
8b0621
@@ -3593,7 +3590,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
8b0621
         buf = apr_pstrcat(p, r->method, " ", url, " HTTP/1.1" CRLF, NULL);
8b0621
     }
8b0621
     if (apr_table_get(r->subprocess_env, "proxy-nokeepalive")) {
8b0621
-        origin->keepalive = AP_CONN_CLOSE;
8b0621
+        if (origin) {
8b0621
+            origin->keepalive = AP_CONN_CLOSE;
8b0621
+        }
8b0621
         p_conn->close = 1;
8b0621
     }
8b0621
     ap_xlate_proto_to_ascii(buf, strlen(buf));
8b0621
@@ -3685,14 +3684,6 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
8b0621
     if (do_100_continue) {
8b0621
         const char *val;
8b0621
 
8b0621
-        if (!r->expecting_100) {
8b0621
-            /* Don't forward any "100 Continue" response if the client is
8b0621
-             * not expecting it.
8b0621
-             */
8b0621
-            apr_table_setn(r->subprocess_env, "proxy-interim-response",
8b0621
-                                              "Suppress");
8b0621
-        }
8b0621
-
8b0621
         /* Add the Expect header if not already there. */
8b0621
         if (((val = apr_table_get(r->headers_in, "Expect")) == NULL)
8b0621
                 || (strcasecmp(val, "100-Continue") != 0 /* fast path */
8b0621
diff --git a/server/protocol.c b/server/protocol.c
8b0621
index 8d90055..8d1fdd2 100644
8b0621
--- a/server/protocol.c
8b0621
+++ b/server/protocol.c
8b0621
@@ -2188,21 +2188,23 @@ AP_DECLARE(void) ap_send_interim_response(request_rec *r, int send_headers)
8b0621
                       "Status is %d - not sending interim response", r->status);
8b0621
         return;
8b0621
     }
8b0621
-    if ((r->status == HTTP_CONTINUE) && !r->expecting_100) {
8b0621
-        /*
8b0621
-         * Don't send 100-Continue when there was no Expect: 100-continue
8b0621
-         * in the request headers. For origin servers this is a SHOULD NOT
8b0621
-         * for proxies it is a MUST NOT according to RFC 2616 8.2.3
8b0621
-         */
8b0621
-        return;
8b0621
-    }
8b0621
+    if (r->status == HTTP_CONTINUE) {
8b0621
+        if (!r->expecting_100) {
8b0621
+            /*
8b0621
+             * Don't send 100-Continue when there was no Expect: 100-continue
8b0621
+             * in the request headers. For origin servers this is a SHOULD NOT
8b0621
+             * for proxies it is a MUST NOT according to RFC 2616 8.2.3
8b0621
+             */
8b0621
+            return;
8b0621
+        }
8b0621
 
8b0621
-    /* if we send an interim response, we're no longer in a state of
8b0621
-     * expecting one.  Also, this could feasibly be in a subrequest,
8b0621
-     * so we need to propagate the fact that we responded.
8b0621
-     */
8b0621
-    for (rr = r; rr != NULL; rr = rr->main) {
8b0621
-        rr->expecting_100 = 0;
8b0621
+        /* if we send an interim response, we're no longer in a state of
8b0621
+         * expecting one.  Also, this could feasibly be in a subrequest,
8b0621
+         * so we need to propagate the fact that we responded.
8b0621
+         */
8b0621
+        for (rr = r; rr != NULL; rr = rr->main) {
8b0621
+            rr->expecting_100 = 0;
8b0621
+        }
8b0621
     }
8b0621
 
8b0621
     status_line = apr_pstrcat(r->pool, AP_SERVER_PROTOCOL, " ", r->status_line, CRLF, NULL);