576df0
diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
576df0
index de48735..d13c249 100644
576df0
--- a/modules/proxy/mod_proxy.c
576df0
+++ b/modules/proxy/mod_proxy.c
576df0
@@ -1574,6 +1574,8 @@ static void *create_proxy_dir_config(apr_pool_t *p, char *dummy)
576df0
     new->error_override_set = 0;
576df0
     new->add_forwarded_headers = 1;
576df0
     new->add_forwarded_headers_set = 0;
576df0
+    new->forward_100_continue = 1;
576df0
+    new->forward_100_continue_set = 0;
576df0
 
576df0
     return (void *) new;
576df0
 }
576df0
@@ -1610,6 +1612,11 @@ static void *merge_proxy_dir_config(apr_pool_t *p, void *basev, void *addv)
576df0
         : add->add_forwarded_headers;
576df0
     new->add_forwarded_headers_set = add->add_forwarded_headers_set
576df0
         || base->add_forwarded_headers_set;
576df0
+    new->forward_100_continue =
576df0
+        (add->forward_100_continue_set == 0) ? base->forward_100_continue
576df0
+                                             : add->forward_100_continue;
576df0
+    new->forward_100_continue_set = add->forward_100_continue_set
576df0
+                                    || base->forward_100_continue_set;
576df0
     
576df0
     return new;
576df0
 }
576df0
@@ -2110,6 +2117,14 @@ static const char *
576df0
     conf->preserve_host_set = 1;
576df0
     return NULL;
576df0
 }
576df0
+static const char *
576df0
+   forward_100_continue(cmd_parms *parms, void *dconf, int flag)
576df0
+{
576df0
+   proxy_dir_conf *conf = dconf;
576df0
+   conf->forward_100_continue = flag;
576df0
+   conf->forward_100_continue_set = 1;
576df0
+   return NULL;
576df0
+}
576df0
 
576df0
 static const char *
576df0
     set_recv_buffer_size(cmd_parms *parms, void *dummy, const char *arg)
576df0
@@ -2683,6 +2698,9 @@ static const command_rec proxy_cmds[] =
576df0
      "Configure local source IP used for request forward"),
576df0
     AP_INIT_FLAG("ProxyAddHeaders", add_proxy_http_headers, NULL, RSRC_CONF|ACCESS_CONF,
576df0
      "on if X-Forwarded-* headers should be added or completed"),
576df0
+    AP_INIT_FLAG("Proxy100Continue", forward_100_continue, NULL, RSRC_CONF|ACCESS_CONF,
576df0
+     "on if 100-Continue should be forwarded to the origin server, off if the "
576df0
+     "proxy should handle it by itself"),
576df0
     {NULL}
576df0
 };
576df0
 
576df0
diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
576df0
index 3419023..288c5d4 100644
576df0
--- a/modules/proxy/mod_proxy.h
576df0
+++ b/modules/proxy/mod_proxy.h
576df0
@@ -240,6 +240,8 @@ typedef struct {
576df0
     /** Named back references */
576df0
     apr_array_header_t *refs;
576df0
 
576df0
+    unsigned int forward_100_continue:1;
576df0
+    unsigned int forward_100_continue_set:1;
576df0
 } proxy_dir_conf;
576df0
 
576df0
 /* if we interpolate env vars per-request, we'll need a per-request
576df0
@@ -380,6 +382,12 @@ do {                             \
576df0
 (w)->s->io_buffer_size_set   = (c)->io_buffer_size_set;    \
576df0
 } while (0)
576df0
 
576df0
+#define PROXY_DO_100_CONTINUE(w, r) \
576df0
+((w)->s->ping_timeout_set \
576df0
+ && (PROXYREQ_REVERSE == (r)->proxyreq) \
576df0
+ && !(apr_table_get((r)->subprocess_env, "force-proxy-request-1.0")) \
576df0
+ && ap_request_has_body((r)))
576df0
+
576df0
 /* use 2 hashes */
576df0
 typedef struct {
576df0
     unsigned int def;
576df0
diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c
576df0
index 8f6f853..8d66b4a 100644
576df0
--- a/modules/proxy/mod_proxy_ftp.c
576df0
+++ b/modules/proxy/mod_proxy_ftp.c
576df0
@@ -1181,12 +1181,10 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker,
576df0
         return HTTP_SERVICE_UNAVAILABLE;
576df0
     }
576df0
 
576df0
-    if (!backend->connection) {
576df0
-        status = ap_proxy_connection_create_ex("FTP", backend, r);
576df0
-        if (status != OK) {
576df0
-            proxy_ftp_cleanup(r, backend);
576df0
-            return status;
576df0
-        }
576df0
+    status = ap_proxy_connection_create_ex("FTP", backend, r);
576df0
+    if (status != OK) {
576df0
+        proxy_ftp_cleanup(r, backend);
576df0
+        return status;
576df0
     }
576df0
 
576df0
     /* Use old naming */
576df0
diff --git a/modules/proxy/mod_proxy_hcheck.c b/modules/proxy/mod_proxy_hcheck.c
576df0
index 2783a58..dd8e407 100644
576df0
--- a/modules/proxy/mod_proxy_hcheck.c
576df0
+++ b/modules/proxy/mod_proxy_hcheck.c
576df0
@@ -762,10 +762,8 @@ static apr_status_t hc_check_http(baton_t *baton)
576df0
     }
576df0
 
576df0
     r = create_request_rec(ptemp, ctx->s, baton->balancer, wctx->method);
576df0
-    if (!backend->connection) {
576df0
-        if ((status = ap_proxy_connection_create_ex("HCOH", backend, r)) != OK) {
576df0
-            return backend_cleanup("HCOH", backend, ctx->s, status);
576df0
-        }
576df0
+    if ((status = ap_proxy_connection_create_ex("HCOH", backend, r)) != OK) {
576df0
+        return backend_cleanup("HCOH", backend, ctx->s, status);
576df0
     }
576df0
     set_request_connection(r, backend->connection);
576df0
 
576df0
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
576df0
index 56af9a8..f007ad6 100644
576df0
--- a/modules/proxy/mod_proxy_http.c
576df0
+++ b/modules/proxy/mod_proxy_http.c
576df0
@@ -216,8 +216,12 @@ static void add_cl(apr_pool_t *p,
576df0
     APR_BRIGADE_INSERT_TAIL(header_brigade, e);
576df0
 }
576df0
 
576df0
-#define ASCII_CRLF  "\015\012"
576df0
-#define ASCII_ZERO  "\060"
576df0
+#ifndef CRLF_ASCII
576df0
+#define CRLF_ASCII  "\015\012"
576df0
+#endif
576df0
+#ifndef ZERO_ASCII
576df0
+#define ZERO_ASCII  "\060"
576df0
+#endif
576df0
 
576df0
 static void terminate_headers(apr_bucket_alloc_t *bucket_alloc,
576df0
                               apr_bucket_brigade *header_brigade)
576df0
@@ -225,304 +229,228 @@ static void terminate_headers(apr_bucket_alloc_t *bucket_alloc,
576df0
     apr_bucket *e;
576df0
 
576df0
     /* add empty line at the end of the headers */
576df0
-    e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
576df0
+    e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
576df0
     APR_BRIGADE_INSERT_TAIL(header_brigade, e);
576df0
 }
576df0
 
576df0
 
576df0
 #define MAX_MEM_SPOOL 16384
576df0
 
576df0
-static int stream_reqbody_chunked(apr_pool_t *p,
576df0
-                                           request_rec *r,
576df0
-                                           proxy_conn_rec *p_conn,
576df0
-                                           conn_rec *origin,
576df0
-                                           apr_bucket_brigade *header_brigade,
576df0
-                                           apr_bucket_brigade *input_brigade)
576df0
-{
576df0
-    int seen_eos = 0, rv = OK;
576df0
-    apr_size_t hdr_len;
576df0
-    apr_off_t bytes;
576df0
-    apr_status_t status;
576df0
-    apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc;
576df0
-    apr_bucket_brigade *bb;
576df0
-    apr_bucket *e;
576df0
-
576df0
-    add_te_chunked(p, bucket_alloc, header_brigade);
576df0
-    terminate_headers(bucket_alloc, header_brigade);
576df0
+typedef enum {
576df0
+    RB_INIT = 0,
576df0
+    RB_STREAM_CL,
576df0
+    RB_STREAM_CHUNKED,
576df0
+    RB_SPOOL_CL
576df0
+} rb_methods;
576df0
 
576df0
-    while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade)))
576df0
-    {
576df0
-        char chunk_hdr[20];  /* must be here due to transient bucket. */
576df0
+typedef struct {
576df0
+    apr_pool_t *p;
576df0
+    request_rec *r;
576df0
+    proxy_worker *worker;
576df0
+    proxy_server_conf *sconf;
576df0
 
576df0
-        /* If this brigade contains EOS, either stop or remove it. */
576df0
-        if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
576df0
-            seen_eos = 1;
576df0
-
576df0
-            /* We can't pass this EOS to the output_filters. */
576df0
-            e = APR_BRIGADE_LAST(input_brigade);
576df0
-            apr_bucket_delete(e);
576df0
-        }
576df0
-
576df0
-        apr_brigade_length(input_brigade, 1, &bytes);
576df0
+    char server_portstr[32];
576df0
+    proxy_conn_rec *backend;
576df0
+    conn_rec *origin;
576df0
 
576df0
-        hdr_len = apr_snprintf(chunk_hdr, sizeof(chunk_hdr),
576df0
-                               "%" APR_UINT64_T_HEX_FMT CRLF,
576df0
-                               (apr_uint64_t)bytes);
576df0
+    apr_bucket_alloc_t *bucket_alloc;
576df0
+    apr_bucket_brigade *header_brigade;
576df0
+    apr_bucket_brigade *input_brigade;
576df0
+    char *old_cl_val, *old_te_val;
576df0
+    apr_off_t cl_val;
576df0
 
576df0
-        ap_xlate_proto_to_ascii(chunk_hdr, hdr_len);
576df0
-        e = apr_bucket_transient_create(chunk_hdr, hdr_len,
576df0
-                                        bucket_alloc);
576df0
-        APR_BRIGADE_INSERT_HEAD(input_brigade, e);
576df0
+    rb_methods rb_method;
576df0
 
576df0
-        /*
576df0
-         * Append the end-of-chunk CRLF
576df0
-         */
576df0
-        e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
576df0
-        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
576df0
+    int expecting_100;
576df0
+    unsigned int do_100_continue:1,
576df0
+                 prefetch_nonblocking:1;
576df0
+} proxy_http_req_t;
576df0
 
576df0
-        if (header_brigade) {
576df0
-            /* we never sent the header brigade, so go ahead and
576df0
-             * take care of that now
576df0
-             */
576df0
-            bb = header_brigade;
576df0
-
576df0
-            /*
576df0
-             * Save input_brigade in bb brigade. (At least) in the SSL case
576df0
-             * input_brigade contains transient buckets whose data would get
576df0
-             * overwritten during the next call of ap_get_brigade in the loop.
576df0
-             * ap_save_brigade ensures these buckets to be set aside.
576df0
-             * Calling ap_save_brigade with NULL as filter is OK, because
576df0
-             * bb brigade already has been created and does not need to get
576df0
-             * created by ap_save_brigade.
576df0
-             */
576df0
-            status = ap_save_brigade(NULL, &bb, &input_brigade, p);
576df0
-            if (status != APR_SUCCESS) {
576df0
-                return HTTP_INTERNAL_SERVER_ERROR;
576df0
-            }
576df0
-
576df0
-            header_brigade = NULL;
576df0
-        }
576df0
-        else {
576df0
-            bb = input_brigade;
576df0
+/* Read what's in the client pipe. If nonblocking is set and read is EAGAIN,
576df0
+ * pass a FLUSH bucket to the backend and read again in blocking mode.
576df0
+ */
576df0
+static int stream_reqbody_read(proxy_http_req_t *req, apr_bucket_brigade *bb,
576df0
+                               int nonblocking)
576df0
+{
576df0
+    request_rec *r = req->r;
576df0
+    proxy_conn_rec *p_conn = req->backend;
576df0
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
576df0
+    apr_read_type_e block = nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ;
576df0
+    apr_status_t status;
576df0
+    int rv;
576df0
+
576df0
+    for (;;) {
576df0
+        status = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
576df0
+                                block, HUGE_STRING_LEN);
576df0
+        if (block == APR_BLOCK_READ
576df0
+                || (!APR_STATUS_IS_EAGAIN(status)
576df0
+                    && (status != APR_SUCCESS || !APR_BRIGADE_EMPTY(bb)))) {
576df0
+            break;
576df0
         }
576df0
 
576df0
-        /* The request is flushed below this loop with chunk EOS header */
576df0
-        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 0);
576df0
+        /* Flush and retry (blocking) */
576df0
+        apr_brigade_cleanup(bb);
576df0
+        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin, bb, 1);
576df0
         if (rv != OK) {
576df0
             return rv;
576df0
         }
576df0
-
576df0
-        if (seen_eos) {
576df0
-            break;
576df0
-        }
576df0
-
576df0
-        status = ap_get_brigade(r->input_filters, input_brigade,
576df0
-                                AP_MODE_READBYTES, APR_BLOCK_READ,
576df0
-                                HUGE_STRING_LEN);
576df0
-
576df0
-        if (status != APR_SUCCESS) {
576df0
-            conn_rec *c = r->connection;
576df0
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608)
576df0
-                          "read request body failed to %pI (%s)"
576df0
-                          " from %s (%s)", p_conn->addr,
576df0
-                          p_conn->hostname ? p_conn->hostname: "",
576df0
-                          c->client_ip, c->remote_host ? c->remote_host: "");
576df0
-            return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
576df0
-        }
576df0
+        block = APR_BLOCK_READ;
576df0
     }
576df0
 
576df0
-    if (header_brigade) {
576df0
-        /* we never sent the header brigade because there was no request body;
576df0
-         * send it now
576df0
-         */
576df0
-        bb = header_brigade;
576df0
-    }
576df0
-    else {
576df0
-        if (!APR_BRIGADE_EMPTY(input_brigade)) {
576df0
-            /* input brigade still has an EOS which we can't pass to the output_filters. */
576df0
-            e = APR_BRIGADE_LAST(input_brigade);
576df0
-            AP_DEBUG_ASSERT(APR_BUCKET_IS_EOS(e));
576df0
-            apr_bucket_delete(e);
576df0
-        }
576df0
-        bb = input_brigade;
576df0
-    }
576df0
-
576df0
-    e = apr_bucket_immortal_create(ASCII_ZERO ASCII_CRLF
576df0
-                                   /* <trailers> */
576df0
-                                   ASCII_CRLF,
576df0
-                                   5, bucket_alloc);
576df0
-    APR_BRIGADE_INSERT_TAIL(bb, e);
576df0
-
576df0
-    if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) {
576df0
-        e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
576df0
-        APR_BRIGADE_INSERT_TAIL(bb, e);
576df0
+    if (status != APR_SUCCESS) {
576df0
+        conn_rec *c = r->connection;
576df0
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608)
576df0
+                      "read request body failed to %pI (%s)"
576df0
+                      " from %s (%s)", p_conn->addr,
576df0
+                      p_conn->hostname ? p_conn->hostname: "",
576df0
+                      c->client_ip, c->remote_host ? c->remote_host: "");
576df0
+        return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
576df0
     }
576df0
 
576df0
-    /* Now we have headers-only, or the chunk EOS mark; flush it */
576df0
-    rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 1);
576df0
-    return rv;
576df0
+    return OK;
576df0
 }
576df0
 
576df0
-static int stream_reqbody_cl(apr_pool_t *p,
576df0
-                                      request_rec *r,
576df0
-                                      proxy_conn_rec *p_conn,
576df0
-                                      conn_rec *origin,
576df0
-                                      apr_bucket_brigade *header_brigade,
576df0
-                                      apr_bucket_brigade *input_brigade,
576df0
-                                      char *old_cl_val)
576df0
+static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method)
576df0
 {
576df0
-    int seen_eos = 0, rv = 0;
576df0
-    apr_status_t status = APR_SUCCESS;
576df0
-    apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc;
576df0
-    apr_bucket_brigade *bb;
576df0
+    request_rec *r = req->r;
576df0
+    int seen_eos = 0, rv = OK;
576df0
+    apr_size_t hdr_len;
576df0
+    char chunk_hdr[20];  /* must be here due to transient bucket. */
576df0
+    proxy_conn_rec *p_conn = req->backend;
576df0
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
576df0
+    apr_bucket_brigade *header_brigade = req->header_brigade;
576df0
+    apr_bucket_brigade *input_brigade = req->input_brigade;
576df0
+    apr_off_t bytes, bytes_streamed = 0;
576df0
     apr_bucket *e;
576df0
-    apr_off_t cl_val = 0;
576df0
-    apr_off_t bytes;
576df0
-    apr_off_t bytes_streamed = 0;
576df0
-
576df0
-    if (old_cl_val) {
576df0
-        char *endstr;
576df0
 
576df0
-        add_cl(p, bucket_alloc, header_brigade, old_cl_val);
576df0
-        status = apr_strtoff(&cl_val, old_cl_val, &endstr, 10);
576df0
-
576df0
-        if (status || *endstr || endstr == old_cl_val || cl_val < 0) {
576df0
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01085)
576df0
-                          "could not parse request Content-Length (%s)",
576df0
-                          old_cl_val);
576df0
-            return HTTP_BAD_REQUEST;
576df0
+    do {
576df0
+        if (APR_BRIGADE_EMPTY(input_brigade)
576df0
+                && APR_BRIGADE_EMPTY(header_brigade)) {
576df0
+            rv = stream_reqbody_read(req, input_brigade, 1);
576df0
+            if (rv != OK) {
576df0
+                return rv;
576df0
+            }
576df0
         }
576df0
-    }
576df0
-    terminate_headers(bucket_alloc, header_brigade);
576df0
-
576df0
-    while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade)))
576df0
-    {
576df0
-        apr_brigade_length(input_brigade, 1, &bytes);
576df0
-        bytes_streamed += bytes;
576df0
-
576df0
-        /* If this brigade contains EOS, either stop or remove it. */
576df0
-        if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
576df0
-            seen_eos = 1;
576df0
 
576df0
-            /* We can't pass this EOS to the output_filters. */
576df0
-            e = APR_BRIGADE_LAST(input_brigade);
576df0
-            apr_bucket_delete(e);
576df0
+        if (!APR_BRIGADE_EMPTY(input_brigade)) {
576df0
+            /* If this brigade contains EOS, either stop or remove it. */
576df0
+            if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
576df0
+                seen_eos = 1;
576df0
 
576df0
-            if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) {
576df0
-                e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
576df0
-                APR_BRIGADE_INSERT_TAIL(input_brigade, e);
576df0
+                /* We can't pass this EOS to the output_filters. */
576df0
+                e = APR_BRIGADE_LAST(input_brigade);
576df0
+                apr_bucket_delete(e);
576df0
             }
576df0
-        }
576df0
 
576df0
-        /* C-L < bytes streamed?!?
576df0
-         * We will error out after the body is completely
576df0
-         * consumed, but we can't stream more bytes at the
576df0
-         * back end since they would in part be interpreted
576df0
-         * as another request!  If nothing is sent, then
576df0
-         * just send nothing.
576df0
-         *
576df0
-         * Prevents HTTP Response Splitting.
576df0
-         */
576df0
-        if (bytes_streamed > cl_val) {
576df0
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01086)
576df0
-                          "read more bytes of request body than expected "
576df0
-                          "(got %" APR_OFF_T_FMT ", expected %" APR_OFF_T_FMT ")",
576df0
-                          bytes_streamed, cl_val);
576df0
-            return HTTP_INTERNAL_SERVER_ERROR;
576df0
-        }
576df0
-
576df0
-        if (header_brigade) {
576df0
-            /* we never sent the header brigade, so go ahead and
576df0
-             * take care of that now
576df0
-             */
576df0
-            bb = header_brigade;
576df0
+            apr_brigade_length(input_brigade, 1, &bytes);
576df0
+            bytes_streamed += bytes;
576df0
 
576df0
-            /*
576df0
-             * Save input_brigade in bb brigade. (At least) in the SSL case
576df0
-             * input_brigade contains transient buckets whose data would get
576df0
-             * overwritten during the next call of ap_get_brigade in the loop.
576df0
-             * ap_save_brigade ensures these buckets to be set aside.
576df0
-             * Calling ap_save_brigade with NULL as filter is OK, because
576df0
-             * bb brigade already has been created and does not need to get
576df0
-             * created by ap_save_brigade.
576df0
-             */
576df0
-            status = ap_save_brigade(NULL, &bb, &input_brigade, p);
576df0
-            if (status != APR_SUCCESS) {
576df0
+            if (rb_method == RB_STREAM_CHUNKED) {
576df0
+                if (bytes) {
576df0
+                    /*
576df0
+                     * Prepend the size of the chunk
576df0
+                     */
576df0
+                    hdr_len = apr_snprintf(chunk_hdr, sizeof(chunk_hdr),
576df0
+                                           "%" APR_UINT64_T_HEX_FMT CRLF,
576df0
+                                           (apr_uint64_t)bytes);
576df0
+                    ap_xlate_proto_to_ascii(chunk_hdr, hdr_len);
576df0
+                    e = apr_bucket_transient_create(chunk_hdr, hdr_len,
576df0
+                                                    bucket_alloc);
576df0
+                    APR_BRIGADE_INSERT_HEAD(input_brigade, e);
576df0
+
576df0
+                    /*
576df0
+                     * Append the end-of-chunk CRLF
576df0
+                     */
576df0
+                    e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
576df0
+                    APR_BRIGADE_INSERT_TAIL(input_brigade, e);
576df0
+                }
576df0
+                if (seen_eos) {
576df0
+                    /*
576df0
+                     * Append the tailing 0-size chunk
576df0
+                     */
576df0
+                    e = apr_bucket_immortal_create(ZERO_ASCII CRLF_ASCII
576df0
+                                                   /* <trailers> */
576df0
+                                                   CRLF_ASCII,
576df0
+                                                   5, bucket_alloc);
576df0
+                    APR_BRIGADE_INSERT_TAIL(input_brigade, e);
576df0
+                }
576df0
+            }
576df0
+            else if (bytes_streamed > req->cl_val) {
576df0
+                /* C-L < bytes streamed?!?
576df0
+                 * We will error out after the body is completely
576df0
+                 * consumed, but we can't stream more bytes at the
576df0
+                 * back end since they would in part be interpreted
576df0
+                 * as another request!  If nothing is sent, then
576df0
+                 * just send nothing.
576df0
+                 *
576df0
+                 * Prevents HTTP Response Splitting.
576df0
+                 */
576df0
+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01086)
576df0
+                              "read more bytes of request body than expected "
576df0
+                              "(got %" APR_OFF_T_FMT ", expected "
576df0
+                              "%" APR_OFF_T_FMT ")",
576df0
+                              bytes_streamed, req->cl_val);
576df0
                 return HTTP_INTERNAL_SERVER_ERROR;
576df0
             }
576df0
 
576df0
-            header_brigade = NULL;
576df0
-        }
576df0
-        else {
576df0
-            bb = input_brigade;
576df0
-        }
576df0
-
576df0
-        /* Once we hit EOS, we are ready to flush. */
576df0
-        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, seen_eos);
576df0
-        if (rv != OK) {
576df0
-            return rv ;
576df0
-        }
576df0
-
576df0
-        if (seen_eos) {
576df0
-            break;
576df0
+            if (seen_eos && apr_table_get(r->subprocess_env,
576df0
+                                          "proxy-sendextracrlf")) {
576df0
+                e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
576df0
+                APR_BRIGADE_INSERT_TAIL(input_brigade, e);
576df0
+            }
576df0
         }
576df0
 
576df0
-        status = ap_get_brigade(r->input_filters, input_brigade,
576df0
-                                AP_MODE_READBYTES, APR_BLOCK_READ,
576df0
-                                HUGE_STRING_LEN);
576df0
+        /* If we never sent the header brigade, go ahead and take care of
576df0
+         * that now by prepending it (once only since header_brigade will be
576df0
+         * empty afterward).
576df0
+         */
576df0
+        APR_BRIGADE_PREPEND(input_brigade, header_brigade);
576df0
 
576df0
-        if (status != APR_SUCCESS) {
576df0
-            conn_rec *c = r->connection;
576df0
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02609)
576df0
-                          "read request body failed to %pI (%s)"
576df0
-                          " from %s (%s)", p_conn->addr,
576df0
-                          p_conn->hostname ? p_conn->hostname: "",
576df0
-                          c->client_ip, c->remote_host ? c->remote_host: "");
576df0
-            return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
576df0
+        /* Flush here on EOS because we won't stream_reqbody_read() again */
576df0
+        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin,
576df0
+                                   input_brigade, seen_eos);
576df0
+        if (rv != OK) {
576df0
+            return rv;
576df0
         }
576df0
-    }
576df0
+    } while (!seen_eos);
576df0
 
576df0
-    if (bytes_streamed != cl_val) {
576df0
+    if (rb_method == RB_STREAM_CL && bytes_streamed != req->cl_val) {
576df0
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01087)
576df0
                       "client %s given Content-Length did not match"
576df0
                       " number of body bytes read", r->connection->client_ip);
576df0
         return HTTP_BAD_REQUEST;
576df0
     }
576df0
 
576df0
-    if (header_brigade) {
576df0
-        /* we never sent the header brigade since there was no request
576df0
-         * body; send it now with the flush flag
576df0
-         */
576df0
-        bb = header_brigade;
576df0
-        return(ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 1));
576df0
-    }
576df0
-
576df0
     return OK;
576df0
 }
576df0
 
576df0
-static int spool_reqbody_cl(apr_pool_t *p,
576df0
-                                     request_rec *r,
576df0
-                                     proxy_conn_rec *p_conn,
576df0
-                                     conn_rec *origin,
576df0
-                                     apr_bucket_brigade *header_brigade,
576df0
-                                     apr_bucket_brigade *input_brigade,
576df0
-                                     int force_cl)
576df0
+static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled)
576df0
 {
576df0
-    int seen_eos = 0;
576df0
-    apr_status_t status;
576df0
-    apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc;
576df0
+    apr_pool_t *p = req->p;
576df0
+    request_rec *r = req->r;
576df0
+    int seen_eos = 0, rv = OK;
576df0
+    apr_status_t status = APR_SUCCESS;
576df0
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
576df0
+    apr_bucket_brigade *input_brigade = req->input_brigade;
576df0
     apr_bucket_brigade *body_brigade;
576df0
     apr_bucket *e;
576df0
-    apr_off_t bytes, bytes_spooled = 0, fsize = 0;
576df0
+    apr_off_t bytes, fsize = 0;
576df0
     apr_file_t *tmpfile = NULL;
576df0
     apr_off_t limit;
576df0
 
576df0
     body_brigade = apr_brigade_create(p, bucket_alloc);
576df0
+    *bytes_spooled = 0;
576df0
 
576df0
     limit = ap_get_limit_req_body(r);
576df0
 
576df0
-    while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade)))
576df0
-    {
576df0
+    do {
576df0
+        if (APR_BRIGADE_EMPTY(input_brigade)) {
576df0
+            rv = stream_reqbody_read(req, input_brigade, 0);
576df0
+            if (rv != OK) {
576df0
+                return rv;
576df0
+            }
576df0
+        }
576df0
+
576df0
         /* If this brigade contains EOS, either stop or remove it. */
576df0
         if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
576df0
             seen_eos = 1;
576df0
@@ -534,13 +462,13 @@ static int spool_reqbody_cl(apr_pool_t *p,
576df0
 
576df0
         apr_brigade_length(input_brigade, 1, &bytes);
576df0
 
576df0
-        if (bytes_spooled + bytes > MAX_MEM_SPOOL) {
576df0
+        if (*bytes_spooled + bytes > MAX_MEM_SPOOL) {
576df0
             /*
576df0
              * LimitRequestBody does not affect Proxy requests (Should it?).
576df0
              * Let it take effect if we decide to store the body in a
576df0
              * temporary file on disk.
576df0
              */
576df0
-            if (limit && (bytes_spooled + bytes > limit)) {
576df0
+            if (limit && (*bytes_spooled + bytes > limit)) {
576df0
                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088)
576df0
                               "Request body is larger than the configured "
576df0
                               "limit of %" APR_OFF_T_FMT, limit);
576df0
@@ -610,69 +538,42 @@ static int spool_reqbody_cl(apr_pool_t *p,
576df0
 
576df0
         }
576df0
 
576df0
-        bytes_spooled += bytes;
576df0
-
576df0
-        if (seen_eos) {
576df0
-            break;
576df0
-        }
576df0
-
576df0
-        status = ap_get_brigade(r->input_filters, input_brigade,
576df0
-                                AP_MODE_READBYTES, APR_BLOCK_READ,
576df0
-                                HUGE_STRING_LEN);
576df0
-
576df0
-        if (status != APR_SUCCESS) {
576df0
-            conn_rec *c = r->connection;
576df0
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02610)
576df0
-                          "read request body failed to %pI (%s)"
576df0
-                          " from %s (%s)", p_conn->addr,
576df0
-                          p_conn->hostname ? p_conn->hostname: "",
576df0
-                          c->client_ip, c->remote_host ? c->remote_host: "");
576df0
-            return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
576df0
-        }
576df0
-    }
576df0
+        *bytes_spooled += bytes;
576df0
+    } while (!seen_eos);
576df0
 
576df0
-    if (bytes_spooled || force_cl) {
576df0
-        add_cl(p, bucket_alloc, header_brigade, apr_off_t_toa(p, bytes_spooled));
576df0
-    }
576df0
-    terminate_headers(bucket_alloc, header_brigade);
576df0
-    APR_BRIGADE_CONCAT(header_brigade, body_brigade);
576df0
+    APR_BRIGADE_CONCAT(input_brigade, body_brigade);
576df0
     if (tmpfile) {
576df0
-        apr_brigade_insert_file(header_brigade, tmpfile, 0, fsize, p);
576df0
+        apr_brigade_insert_file(input_brigade, tmpfile, 0, fsize, p);
576df0
     }
576df0
     if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) {
576df0
-        e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc);
576df0
-        APR_BRIGADE_INSERT_TAIL(header_brigade, e);
576df0
+        e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
576df0
+        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
576df0
     }
576df0
-    /* This is all a single brigade, pass with flush flagged */
576df0
-    return(ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, header_brigade, 1));
576df0
+    return OK;
576df0
 }
576df0
 
576df0
-static
576df0
-int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
-                                   proxy_conn_rec *p_conn, proxy_worker *worker,
576df0
-                                   proxy_server_conf *conf,
576df0
-                                   apr_uri_t *uri,
576df0
-                                   char *url, char *server_portstr)
576df0
+static int ap_proxy_http_prefetch(proxy_http_req_t *req,
576df0
+                                  apr_uri_t *uri, char *url)
576df0
 {
576df0
+    apr_pool_t *p = req->p;
576df0
+    request_rec *r = req->r;
576df0
     conn_rec *c = r->connection;
576df0
-    apr_bucket_alloc_t *bucket_alloc = c->bucket_alloc;
576df0
-    apr_bucket_brigade *header_brigade;
576df0
-    apr_bucket_brigade *input_brigade;
576df0
+    proxy_conn_rec *p_conn = req->backend;
576df0
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
576df0
+    apr_bucket_brigade *header_brigade = req->header_brigade;
576df0
+    apr_bucket_brigade *input_brigade = req->input_brigade;
576df0
     apr_bucket_brigade *temp_brigade;
576df0
     apr_bucket *e;
576df0
     char *buf;
576df0
     apr_status_t status;
576df0
-    enum rb_methods {RB_INIT, RB_STREAM_CL, RB_STREAM_CHUNKED, RB_SPOOL_CL};
576df0
-    enum rb_methods rb_method = RB_INIT;
576df0
-    char *old_cl_val = NULL;
576df0
-    char *old_te_val = NULL;
576df0
     apr_off_t bytes_read = 0;
576df0
     apr_off_t bytes;
576df0
     int force10, rv;
576df0
+    apr_read_type_e block;
576df0
     conn_rec *origin = p_conn->connection;
576df0
 
576df0
     if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) {
576df0
-        if (r->expecting_100) {
576df0
+        if (req->expecting_100) {
576df0
             return HTTP_EXPECTATION_FAILED;
576df0
         }
576df0
         force10 = 1;
576df0
@@ -680,17 +581,14 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
         force10 = 0;
576df0
     }
576df0
 
576df0
-    header_brigade = apr_brigade_create(p, bucket_alloc);
576df0
     rv = ap_proxy_create_hdrbrgd(p, header_brigade, r, p_conn,
576df0
-                                 worker, conf, uri, url, server_portstr,
576df0
-                                 &old_cl_val, &old_te_val);
576df0
+                                 req->worker, req->sconf,
576df0
+                                 uri, url, req->server_portstr,
576df0
+                                 &req->old_cl_val, &req->old_te_val);
576df0
     if (rv != OK) {
576df0
         return rv;
576df0
     }
576df0
 
576df0
-    /* We have headers, let's figure out our request body... */
576df0
-    input_brigade = apr_brigade_create(p, bucket_alloc);
576df0
-
576df0
     /* sub-requests never use keepalives, and mustn't pass request bodies.
576df0
      * Because the new logic looks at input_brigade, we will self-terminate
576df0
      * input_brigade and jump past all of the request body logic...
576df0
@@ -703,9 +601,9 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
     if (!r->kept_body && r->main) {
576df0
         /* XXX: Why DON'T sub-requests use keepalives? */
576df0
         p_conn->close = 1;
576df0
-        old_cl_val = NULL;
576df0
-        old_te_val = NULL;
576df0
-        rb_method = RB_STREAM_CL;
576df0
+        req->old_te_val = NULL;
576df0
+        req->old_cl_val = NULL;
576df0
+        req->rb_method = RB_STREAM_CL;
576df0
         e = apr_bucket_eos_create(input_brigade->bucket_alloc);
576df0
         APR_BRIGADE_INSERT_TAIL(input_brigade, e);
576df0
         goto skip_body;
576df0
@@ -719,18 +617,19 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
      * encoding has been done by the extensions' handler, and
576df0
      * do not modify add_te_chunked's logic
576df0
      */
576df0
-    if (old_te_val && strcasecmp(old_te_val, "chunked") != 0) {
576df0
+    if (req->old_te_val && ap_cstr_casecmp(req->old_te_val, "chunked") != 0) {
576df0
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01093)
576df0
-                      "%s Transfer-Encoding is not supported", old_te_val);
576df0
+                      "%s Transfer-Encoding is not supported",
576df0
+                      req->old_te_val);
576df0
         return HTTP_INTERNAL_SERVER_ERROR;
576df0
     }
576df0
 
576df0
-    if (old_cl_val && old_te_val) {
576df0
+    if (req->old_cl_val && req->old_te_val) {
576df0
         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01094)
576df0
                       "client %s (%s) requested Transfer-Encoding "
576df0
                       "chunked body with Content-Length (C-L ignored)",
576df0
                       c->client_ip, c->remote_host ? c->remote_host: "");
576df0
-        old_cl_val = NULL;
576df0
+        req->old_cl_val = NULL;
576df0
         origin->keepalive = AP_CONN_CLOSE;
576df0
         p_conn->close = 1;
576df0
     }
576df0
@@ -744,10 +643,19 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
      * reasonable size.
576df0
      */
576df0
     temp_brigade = apr_brigade_create(p, bucket_alloc);
576df0
+    block = req->prefetch_nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ;
576df0
     do {
576df0
         status = ap_get_brigade(r->input_filters, temp_brigade,
576df0
-                                AP_MODE_READBYTES, APR_BLOCK_READ,
576df0
+                                AP_MODE_READBYTES, block,
576df0
                                 MAX_MEM_SPOOL - bytes_read);
576df0
+        /* ap_get_brigade may return success with an empty brigade
576df0
+         * for a non-blocking read which would block
576df0
+         */
576df0
+        if (block == APR_NONBLOCK_READ
576df0
+            && ((status == APR_SUCCESS && APR_BRIGADE_EMPTY(temp_brigade))
576df0
+                || APR_STATUS_IS_EAGAIN(status))) {
576df0
+            break;
576df0
+        }
576df0
         if (status != APR_SUCCESS) {
576df0
             ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01095)
576df0
                           "prefetch request body failed to %pI (%s)"
576df0
@@ -785,7 +693,8 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
      * (an arbitrary value.)
576df0
      */
576df0
     } while ((bytes_read < MAX_MEM_SPOOL - 80)
576df0
-              && !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)));
576df0
+              && !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))
576df0
+              && !req->prefetch_nonblocking);
576df0
 
576df0
     /* Use chunked request body encoding or send a content-length body?
576df0
      *
576df0
@@ -822,7 +731,8 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
      * is absent, and the filters are unchanged (the body won't
576df0
      * be resized by another content filter).
576df0
      */
576df0
-    if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
576df0
+    if (!APR_BRIGADE_EMPTY(input_brigade)
576df0
+        && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
576df0
         /* The whole thing fit, so our decision is trivial, use
576df0
          * the filtered bytes read from the client for the request
576df0
          * body Content-Length.
576df0
@@ -830,34 +740,43 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
          * If we expected no body, and read no body, do not set
576df0
          * the Content-Length.
576df0
          */
576df0
-        if (old_cl_val || old_te_val || bytes_read) {
576df0
-            old_cl_val = apr_off_t_toa(r->pool, bytes_read);
576df0
+        if (req->old_cl_val || req->old_te_val || bytes_read) {
576df0
+            req->old_cl_val = apr_off_t_toa(r->pool, bytes_read);
576df0
+            req->cl_val = bytes_read;
576df0
         }
576df0
-        rb_method = RB_STREAM_CL;
576df0
+        req->rb_method = RB_STREAM_CL;
576df0
     }
576df0
-    else if (old_te_val) {
576df0
+    else if (req->old_te_val) {
576df0
         if (force10
576df0
              || (apr_table_get(r->subprocess_env, "proxy-sendcl")
576df0
                   && !apr_table_get(r->subprocess_env, "proxy-sendchunks")
576df0
                   && !apr_table_get(r->subprocess_env, "proxy-sendchunked"))) {
576df0
-            rb_method = RB_SPOOL_CL;
576df0
+            req->rb_method = RB_SPOOL_CL;
576df0
         }
576df0
         else {
576df0
-            rb_method = RB_STREAM_CHUNKED;
576df0
+            req->rb_method = RB_STREAM_CHUNKED;
576df0
         }
576df0
     }
576df0
-    else if (old_cl_val) {
576df0
+    else if (req->old_cl_val) {
576df0
         if (r->input_filters == r->proto_input_filters) {
576df0
-            rb_method = RB_STREAM_CL;
576df0
+            char *endstr;
576df0
+            status = apr_strtoff(&req->cl_val, req->old_cl_val, &endstr, 10);
576df0
+            if (status != APR_SUCCESS || *endstr || req->cl_val < 0) {
576df0
+                ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01085)
576df0
+                              "could not parse request Content-Length (%s)",
576df0
+                              req->old_cl_val);
576df0
+                return HTTP_BAD_REQUEST;
576df0
+            }
576df0
+            req->rb_method = RB_STREAM_CL;
576df0
         }
576df0
         else if (!force10
576df0
                   && (apr_table_get(r->subprocess_env, "proxy-sendchunks")
576df0
                       || apr_table_get(r->subprocess_env, "proxy-sendchunked"))
576df0
                   && !apr_table_get(r->subprocess_env, "proxy-sendcl")) {
576df0
-            rb_method = RB_STREAM_CHUNKED;
576df0
+            req->rb_method = RB_STREAM_CHUNKED;
576df0
         }
576df0
         else {
576df0
-            rb_method = RB_SPOOL_CL;
576df0
+            req->rb_method = RB_SPOOL_CL;
576df0
         }
576df0
     }
576df0
     else {
576df0
@@ -865,7 +784,31 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
576df0
          * requests, and has the behavior that it will not add any C-L
576df0
          * when the old_cl_val is NULL.
576df0
          */
576df0
-        rb_method = RB_SPOOL_CL;
576df0
+        req->rb_method = RB_SPOOL_CL;
576df0
+    }
576df0
+
576df0
+    switch (req->rb_method) {
576df0
+    case RB_STREAM_CHUNKED:
576df0
+        add_te_chunked(req->p, bucket_alloc, header_brigade);
576df0
+        break;
576df0
+
576df0
+    case RB_STREAM_CL:
576df0
+        if (req->old_cl_val) {
576df0
+            add_cl(req->p, bucket_alloc, header_brigade, req->old_cl_val);
576df0
+        }
576df0
+        break;
576df0
+
576df0
+    default: /* => RB_SPOOL_CL */
576df0
+        /* If we have to spool the body, do it now, before connecting or
576df0
+         * reusing the backend connection.
576df0
+         */
576df0
+        rv = spool_reqbody_cl(req, &bytes);
576df0
+        if (rv != OK) {
576df0
+            return rv;
576df0
+        }
576df0
+        if (bytes || req->old_te_val || req->old_cl_val) {
576df0
+            add_cl(p, bucket_alloc, header_brigade, apr_off_t_toa(p, bytes));
576df0
+        }
576df0
     }
576df0
 
576df0
 /* Yes I hate gotos.  This is the subrequest shortcut */
576df0
@@ -886,23 +829,44 @@ skip_body:
576df0
         e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
576df0
         APR_BRIGADE_INSERT_TAIL(header_brigade, e);
576df0
     }
576df0
+    terminate_headers(bucket_alloc, header_brigade);
576df0
 
576df0
-    /* send the request body, if any. */
576df0
-    switch(rb_method) {
576df0
-    case RB_STREAM_CHUNKED:
576df0
-        rv = stream_reqbody_chunked(p, r, p_conn, origin, header_brigade,
576df0
-                                        input_brigade);
576df0
-        break;
576df0
+    return OK;
576df0
+}
576df0
+
576df0
+static int ap_proxy_http_request(proxy_http_req_t *req)
576df0
+{
576df0
+    int rv;
576df0
+    request_rec *r = req->r;
576df0
+    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
576df0
+    apr_bucket_brigade *header_brigade = req->header_brigade;
576df0
+    apr_bucket_brigade *input_brigade = req->input_brigade;
576df0
+
576df0
+    /* send the request header/body, if any. */
576df0
+    switch (req->rb_method) {
576df0
     case RB_STREAM_CL:
576df0
-        rv = stream_reqbody_cl(p, r, p_conn, origin, header_brigade,
576df0
-                                   input_brigade, old_cl_val);
576df0
+    case RB_STREAM_CHUNKED:
576df0
+        if (req->do_100_continue) {
576df0
+            rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend,
576df0
+                                       req->origin, header_brigade, 1);
576df0
+        }
576df0
+        else {
576df0
+            rv = stream_reqbody(req, req->rb_method);
576df0
+        }
576df0
         break;
576df0
+
576df0
     case RB_SPOOL_CL:
576df0
-        rv = spool_reqbody_cl(p, r, p_conn, origin, header_brigade,
576df0
-                                  input_brigade, (old_cl_val != NULL)
576df0
-                                              || (old_te_val != NULL)
576df0
-                                              || (bytes_read > 0));
576df0
+        /* Prefetch has built the header and spooled the whole body;
576df0
+         * if we don't expect 100-continue we can flush both all at once,
576df0
+         * otherwise flush the header only.
576df0
+         */
576df0
+        if (!req->do_100_continue) {
576df0
+            APR_BRIGADE_CONCAT(header_brigade, input_brigade);
576df0
+        }
576df0
+        rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend,
576df0
+                                   req->origin, header_brigade, 1);
576df0
         break;
576df0
+
576df0
     default:
576df0
         /* shouldn't be possible */
576df0
         rv = HTTP_INTERNAL_SERVER_ERROR;
576df0
@@ -910,10 +874,12 @@ skip_body:
576df0
     }
576df0
 
576df0
     if (rv != OK) {
576df0
+        conn_rec *c = r->connection;
576df0
         /* apr_status_t value has been logged in lower level method */
576df0
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01097)
576df0
                       "pass request body failed to %pI (%s) from %s (%s)",
576df0
-                      p_conn->addr, p_conn->hostname ? p_conn->hostname: "",
576df0
+                      req->backend->addr,
576df0
+                      req->backend->hostname ? req->backend->hostname: "",
576df0
                       c->client_ip, c->remote_host ? c->remote_host: "");
576df0
         return rv;
576df0
     }
576df0
@@ -1189,12 +1155,16 @@ static int add_trailers(void *data, const char *key, const char *val)
576df0
 }
576df0
 
576df0
 static
576df0
-apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
-                                            proxy_conn_rec **backend_ptr,
576df0
-                                            proxy_worker *worker,
576df0
-                                            proxy_server_conf *conf,
576df0
-                                            char *server_portstr) {
576df0
+int ap_proxy_http_process_response(proxy_http_req_t *req)
576df0
+{
576df0
+    apr_pool_t *p = req->p;
576df0
+    request_rec *r = req->r;
576df0
     conn_rec *c = r->connection;
576df0
+    proxy_worker *worker = req->worker;
576df0
+    proxy_conn_rec *backend = req->backend;
576df0
+    conn_rec *origin = req->origin;
576df0
+    int do_100_continue = req->do_100_continue;
576df0
+
576df0
     char *buffer;
576df0
     char fixed_buffer[HUGE_STRING_LEN];
576df0
     const char *buf;
576df0
@@ -1217,19 +1187,11 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
     int proxy_status = OK;
576df0
     const char *original_status_line = r->status_line;
576df0
     const char *proxy_status_line = NULL;
576df0
-    proxy_conn_rec *backend = *backend_ptr;
576df0
-    conn_rec *origin = backend->connection;
576df0
     apr_interval_time_t old_timeout = 0;
576df0
     proxy_dir_conf *dconf;
576df0
-    int do_100_continue;
576df0
 
576df0
     dconf = ap_get_module_config(r->per_dir_config, &proxy_module);
576df0
 
576df0
-    do_100_continue = (worker->s->ping_timeout_set
576df0
-                       && ap_request_has_body(r)
576df0
-                       && (PROXYREQ_REVERSE == r->proxyreq)
576df0
-                       && !(apr_table_get(r->subprocess_env, "force-proxy-request-1.0")));
576df0
-
576df0
     bb = apr_brigade_create(p, c->bucket_alloc);
576df0
     pass_bb = apr_brigade_create(p, c->bucket_alloc);
576df0
 
576df0
@@ -1248,7 +1210,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
     }
576df0
 
576df0
     /* Setup for 100-Continue timeout if appropriate */
576df0
-    if (do_100_continue) {
576df0
+    if (do_100_continue && worker->s->ping_timeout_set) {
576df0
         apr_socket_timeout_get(backend->sock, &old_timeout);
576df0
         if (worker->s->ping_timeout != old_timeout) {
576df0
             apr_status_t rc;
576df0
@@ -1273,6 +1235,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
                    origin->local_addr->port));
576df0
     do {
576df0
         apr_status_t rc;
576df0
+        int major = 0, minor = 0;
576df0
+        int toclose = 0;
576df0
 
576df0
         apr_brigade_cleanup(bb);
576df0
 
576df0
@@ -1360,9 +1324,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
          * This is buggy if we ever see an HTTP/1.10
576df0
          */
576df0
         if (apr_date_checkmask(buffer, "HTTP/#.# ###*")) {
576df0
-            int major, minor;
576df0
-            int toclose;
576df0
-
576df0
             major = buffer[5] - '0';
576df0
             minor = buffer[7] - '0';
576df0
 
576df0
@@ -1412,8 +1373,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
                          "Set-Cookie", NULL);
576df0
 
576df0
             /* shove the headers direct into r->headers_out */
576df0
-            ap_proxy_read_headers(r, backend->r, buffer, response_field_size, origin,
576df0
-                                  &pread_len);
576df0
+            ap_proxy_read_headers(r, backend->r, buffer, response_field_size,
576df0
+                                  origin, &pread_len);
576df0
 
576df0
             if (r->headers_out == NULL) {
576df0
                 ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01106)
576df0
@@ -1491,7 +1452,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
             r->headers_out = ap_proxy_clean_warnings(p, r->headers_out);
576df0
 
576df0
             /* handle Via header in response */
576df0
-            if (conf->viaopt != via_off && conf->viaopt != via_block) {
576df0
+            if (req->sconf->viaopt != via_off
576df0
+                    && req->sconf->viaopt != via_block) {
576df0
                 const char *server_name = ap_get_server_name(r);
576df0
                 /* If USE_CANONICAL_NAME_OFF was configured for the proxy virtual host,
576df0
                  * then the server name returned by ap_get_server_name() is the
576df0
@@ -1502,18 +1464,18 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
                     server_name = r->server->server_hostname;
576df0
                 /* create a "Via:" response header entry and merge it */
576df0
                 apr_table_addn(r->headers_out, "Via",
576df0
-                               (conf->viaopt == via_full)
576df0
+                               (req->sconf->viaopt == via_full)
576df0
                                      ? apr_psprintf(p, "%d.%d %s%s (%s)",
576df0
                                            HTTP_VERSION_MAJOR(r->proto_num),
576df0
                                            HTTP_VERSION_MINOR(r->proto_num),
576df0
                                            server_name,
576df0
-                                           server_portstr,
576df0
+                                           req->server_portstr,
576df0
                                            AP_SERVER_BASEVERSION)
576df0
                                      : apr_psprintf(p, "%d.%d %s%s",
576df0
                                            HTTP_VERSION_MAJOR(r->proto_num),
576df0
                                            HTTP_VERSION_MINOR(r->proto_num),
576df0
                                            server_name,
576df0
-                                           server_portstr)
576df0
+                                           req->server_portstr)
576df0
                 );
576df0
             }
576df0
 
576df0
@@ -1531,18 +1493,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
         }
576df0
 
576df0
         if (ap_is_HTTP_INFO(proxy_status)) {
576df0
-            interim_response++;
576df0
-            /* Reset to old timeout iff we've adjusted it */
576df0
-            if (do_100_continue
576df0
-                && (r->status == HTTP_CONTINUE)
576df0
-                && (worker->s->ping_timeout != old_timeout)) {
576df0
-                    apr_socket_timeout_set(backend->sock, old_timeout);
576df0
-            }
576df0
-        }
576df0
-        else {
576df0
-            interim_response = 0;
576df0
-        }
576df0
-        if (interim_response) {
576df0
             /* RFC2616 tells us to forward this.
576df0
              *
576df0
              * OTOH, an interim response here may mean the backend
576df0
@@ -1563,7 +1513,13 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
576df0
                           "HTTP: received interim %d response", r->status);
576df0
             if (!policy
576df0
-                    || (!strcasecmp(policy, "RFC") && ((r->expecting_100 = 1)))) {
576df0
+                    || (!strcasecmp(policy, "RFC")
576df0
+                        && (proxy_status != HTTP_CONTINUE
576df0
+                            || (req->expecting_100 = 1)))) {
576df0
+                if (proxy_status == HTTP_CONTINUE) {
576df0
+                    r->expecting_100 = req->expecting_100;
576df0
+                    req->expecting_100 = 0;
576df0
+                }
576df0
                 ap_send_interim_response(r, 1);
576df0
             }
576df0
             /* FIXME: refine this to be able to specify per-response-status
576df0
@@ -1573,7 +1529,106 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
                 ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01108)
576df0
                               "undefined proxy interim response policy");
576df0
             }
576df0
+            interim_response++;
576df0
         }
576df0
+        else {
576df0
+            interim_response = 0;
576df0
+        }
576df0
+
576df0
+        /* If we still do 100-continue (end-to-end or ping), either the
576df0
+         * current response is the expected "100 Continue" and we are done
576df0
+         * with this mode, or this is another interim response and we'll wait
576df0
+         * for the next one, or this is a final response and hence the backend
576df0
+         * did not honor our expectation.
576df0
+         */
576df0
+        if (do_100_continue && (!interim_response
576df0
+                                || proxy_status == HTTP_CONTINUE)) {
576df0
+            /* RFC 7231 - Section 5.1.1 - Expect - Requirement for servers
576df0
+             *   A server that responds with a final status code before
576df0
+             *   reading the entire message body SHOULD indicate in that
576df0
+             *   response whether it intends to close the connection or
576df0
+             *   continue reading and discarding the request message.
576df0
+             *
576df0
+             * So, if this response is not an interim 100 Continue, we can
576df0
+             * avoid sending the request body if the backend responded with
576df0
+             * "Connection: close" or HTTP < 1.1, and either let the core
576df0
+             * discard it or the caller try another balancer member with the
576df0
+             * same body (given status 503, though not implemented yet).
576df0
+             */
576df0
+            int do_send_body = (proxy_status == HTTP_CONTINUE
576df0
+                                || (!toclose && major > 0 && minor > 0));
576df0
+
576df0
+            /* Reset to old timeout iff we've adjusted it. */
576df0
+            if (worker->s->ping_timeout_set) {
576df0
+                apr_socket_timeout_set(backend->sock, old_timeout);
576df0
+            }
576df0
+
576df0
+            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(10153)
576df0
+                          "HTTP: %s100 continue sent by %pI (%s): "
576df0
+                          "%ssending body (response: HTTP/%i.%i %s)",
576df0
+                          proxy_status != HTTP_CONTINUE ? "no " : "",
576df0
+                          backend->addr,
576df0
+                          backend->hostname ? backend->hostname : "",
576df0
+                          do_send_body ? "" : "not ",
576df0
+                          major, minor, proxy_status_line);
576df0
+
576df0
+            if (do_send_body) {
576df0
+                int status;
576df0
+
576df0
+                /* Send the request body (fully). */
576df0
+                switch(req->rb_method) {
576df0
+                case RB_STREAM_CL:
576df0
+                case RB_STREAM_CHUNKED:
576df0
+                    status = stream_reqbody(req, req->rb_method);
576df0
+                    break;
576df0
+                case RB_SPOOL_CL:
576df0
+                    /* Prefetch has spooled the whole body, flush it. */
576df0
+                    status = ap_proxy_pass_brigade(req->bucket_alloc, r,
576df0
+                                                   backend, origin,
576df0
+                                                   req->input_brigade, 1);
576df0
+                    break;
576df0
+                default:
576df0
+                    /* Shouldn't happen */
576df0
+                    status = HTTP_INTERNAL_SERVER_ERROR;
576df0
+                    break;
576df0
+                }
576df0
+                if (status != OK) {
576df0
+                    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
576df0
+                            APLOGNO(10154) "pass request body failed "
576df0
+                            "to %pI (%s) from %s (%s) with status %i",
576df0
+                            backend->addr,
576df0
+                            backend->hostname ? backend->hostname : "",
576df0
+                            c->client_ip,
576df0
+                            c->remote_host ? c->remote_host : "",
576df0
+                            status);
576df0
+                    backend->close = 1;
576df0
+                    return status;
576df0
+                }
576df0
+            }
576df0
+            else {
576df0
+                /* If we don't read the client connection any further, since
576df0
+                 * there are pending data it should be "Connection: close"d to
576df0
+                 * prevent reuse. We don't exactly c->keepalive = AP_CONN_CLOSE
576df0
+                 * here though, because error_override or a potential retry on
576df0
+                 * another backend could finally read that data and finalize
576df0
+                 * the request processing, making keep-alive possible. So what
576df0
+                 * we do is restoring r->expecting_100 for ap_set_keepalive()
576df0
+                 * to do the right thing according to the final response and
576df0
+                 * any later update of r->expecting_100.
576df0
+                 */
576df0
+                r->expecting_100 = req->expecting_100;
576df0
+                req->expecting_100 = 0;
576df0
+            }
576df0
+
576df0
+            /* Once only! */
576df0
+            do_100_continue = 0;
576df0
+        }
576df0
+
576df0
+        if (interim_response) {
576df0
+            /* Already forwarded above, read next response */
576df0
+            continue;
576df0
+        }
576df0
+
576df0
         /* Moved the fixups of Date headers and those affected by
576df0
          * ProxyPassReverse/etc from here to ap_proxy_read_headers
576df0
          */
576df0
@@ -1648,7 +1703,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
 
576df0
         /* send body - but only if a body is expected */
576df0
         if ((!r->header_only) &&                   /* not HEAD request */
576df0
-            !interim_response &&                   /* not any 1xx response */
576df0
             (proxy_status != HTTP_NO_CONTENT) &&      /* not 204 */
576df0
             (proxy_status != HTTP_NOT_MODIFIED)) {    /* not 304 */
576df0
 
576df0
@@ -1697,7 +1751,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
 
576df0
                     rv = ap_get_brigade(backend->r->input_filters, bb,
576df0
                                         AP_MODE_READBYTES, mode,
576df0
-                                        conf->io_buffer_size);
576df0
+                                        req->sconf->io_buffer_size);
576df0
 
576df0
                     /* ap_get_brigade will return success with an empty brigade
576df0
                      * for a non-blocking read which would block: */
576df0
@@ -1789,7 +1843,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
                         ap_proxy_release_connection(backend->worker->s->scheme,
576df0
                                 backend, r->server);
576df0
                         /* Ensure that the backend is not reused */
576df0
-                        *backend_ptr = NULL;
576df0
+                        req->backend = NULL;
576df0
 
576df0
                     }
576df0
 
576df0
@@ -1798,12 +1852,13 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
                         || c->aborted) {
576df0
                         /* Ack! Phbtt! Die! User aborted! */
576df0
                         /* Only close backend if we haven't got all from the
576df0
-                         * backend. Furthermore if *backend_ptr is NULL it is no
576df0
+                         * backend. Furthermore if req->backend is NULL it is no
576df0
                          * longer safe to fiddle around with backend as it might
576df0
                          * be already in use by another thread.
576df0
                          */
576df0
-                        if (*backend_ptr) {
576df0
-                            backend->close = 1;  /* this causes socket close below */
576df0
+                        if (req->backend) {
576df0
+                            /* this causes socket close below */
576df0
+                            req->backend->close = 1;
576df0
                         }
576df0
                         finish = TRUE;
576df0
                     }
576df0
@@ -1816,7 +1871,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
             }
576df0
             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, "end body send");
576df0
         }
576df0
-        else if (!interim_response) {
576df0
+        else {
576df0
             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, "header only");
576df0
 
576df0
             /* make sure we release the backend connection as soon
576df0
@@ -1826,7 +1881,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
576df0
              */
576df0
             ap_proxy_release_connection(backend->worker->s->scheme,
576df0
                     backend, r->server);
576df0
-            *backend_ptr = NULL;
576df0
+            req->backend = NULL;
576df0
 
576df0
             /* Pass EOS bucket down the filter chain. */
576df0
             e = apr_bucket_eos_create(c->bucket_alloc);
576df0
@@ -1880,14 +1935,17 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
576df0
                               apr_port_t proxyport)
576df0
 {
576df0
     int status;
576df0
-    char server_portstr[32];
576df0
     char *scheme;
576df0
     const char *proxy_function;
576df0
     const char *u;
576df0
+    proxy_http_req_t *req = NULL;
576df0
     proxy_conn_rec *backend = NULL;
576df0
     int is_ssl = 0;
576df0
     conn_rec *c = r->connection;
576df0
+    proxy_dir_conf *dconf;
576df0
     int retry = 0;
576df0
+    char *locurl = url;
576df0
+    int toclose = 0;
576df0
     /*
576df0
      * Use a shorter-lived pool to reduce memory usage
576df0
      * and avoid a memory leak
576df0
@@ -1928,14 +1986,47 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
576df0
     }
576df0
     ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "HTTP: serving URL %s", url);
576df0
 
576df0
-
576df0
     /* create space for state information */
576df0
     if ((status = ap_proxy_acquire_connection(proxy_function, &backend,
576df0
-                                              worker, r->server)) != OK)
576df0
-        goto cleanup;
576df0
+                                              worker, r->server)) != OK) {
576df0
+        return status;
576df0
+    }
576df0
 
576df0
     backend->is_ssl = is_ssl;
576df0
 
576df0
+    req = apr_pcalloc(p, sizeof(*req));
576df0
+    req->p = p;
576df0
+    req->r = r;
576df0
+    req->sconf = conf;
576df0
+    req->worker = worker;
576df0
+    req->backend = backend;
576df0
+    req->bucket_alloc = c->bucket_alloc;
576df0
+    req->rb_method = RB_INIT;
576df0
+
576df0
+    dconf = ap_get_module_config(r->per_dir_config, &proxy_module);
576df0
+
576df0
+    /* Should we handle end-to-end or ping 100-continue? */
576df0
+    if ((r->expecting_100 && dconf->forward_100_continue)
576df0
+            || PROXY_DO_100_CONTINUE(worker, r)) {
576df0
+        /* We need to reset r->expecting_100 or prefetching will cause
576df0
+         * ap_http_filter() to send "100 Continue" response by itself. So
576df0
+         * we'll use req->expecting_100 in mod_proxy_http to determine whether
576df0
+         * the client should be forwarded "100 continue", and r->expecting_100
576df0
+         * will be restored at the end of the function with the actual value of
576df0
+         * req->expecting_100 (i.e. cleared only if mod_proxy_http sent the
576df0
+         * "100 Continue" according to its policy).
576df0
+         */
576df0
+        req->do_100_continue = req->prefetch_nonblocking = 1;
576df0
+        req->expecting_100 = r->expecting_100;
576df0
+        r->expecting_100 = 0;
576df0
+    }
576df0
+    /* Should we block while prefetching the body or try nonblocking and flush
576df0
+     * data to the backend ASAP?
576df0
+     */
576df0
+    else if (apr_table_get(r->subprocess_env, "proxy-prefetch-nonblocking")) {
576df0
+        req->prefetch_nonblocking = 1;
576df0
+    }
576df0
+
576df0
     /*
576df0
      * In the case that we are handling a reverse proxy connection and this
576df0
      * is not a request that is coming over an already kept alive connection
576df0
@@ -1949,15 +2040,53 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
576df0
         backend->close = 1;
576df0
     }
576df0
 
576df0
+    /* Step One: Determine Who To Connect To */
576df0
+    if ((status = ap_proxy_determine_connection(p, r, conf, worker, backend,
576df0
+                                            uri, &locurl, proxyname,
576df0
+                                            proxyport, req->server_portstr,
576df0
+                                            sizeof(req->server_portstr))))
576df0
+        goto cleanup;
576df0
+
576df0
+    /* Prefetch (nonlocking) the request body so to increase the chance to get
576df0
+     * the whole (or enough) body and determine Content-Length vs chunked or
576df0
+     * spooled. By doing this before connecting or reusing the backend, we want
576df0
+     * to minimize the delay between this connection is considered alive and
576df0
+     * the first bytes sent (should the client's link be slow or some input
576df0
+     * filter retain the data). This is a best effort to prevent the backend
576df0
+     * from closing (from under us) what it thinks is an idle connection, hence
576df0
+     * to reduce to the minimum the unavoidable local is_socket_connected() vs
576df0
+     * remote keepalive race condition.
576df0
+     */
576df0
+    req->input_brigade = apr_brigade_create(p, req->bucket_alloc);
576df0
+    req->header_brigade = apr_brigade_create(p, req->bucket_alloc);
576df0
+    if ((status = ap_proxy_http_prefetch(req, uri, locurl)) != OK)
576df0
+        goto cleanup;
576df0
+
576df0
+    /* We need to reset backend->close now, since ap_proxy_http_prefetch() set
576df0
+     * it to disable the reuse of the connection *after* this request (no keep-
576df0
+     * alive), not to close any reusable connection before this request. However
576df0
+     * assure what is expected later by using a local flag and do the right thing
576df0
+     * when ap_proxy_connect_backend() below provides the connection to close.
576df0
+     */
576df0
+    toclose = backend->close;
576df0
+    backend->close = 0;
576df0
+
576df0
     while (retry < 2) {
576df0
-        char *locurl = url;
576df0
+        if (retry) {
576df0
+            char *newurl = url;
576df0
 
576df0
-        /* Step One: Determine Who To Connect To */
576df0
-        if ((status = ap_proxy_determine_connection(p, r, conf, worker, backend,
576df0
-                                                uri, &locurl, proxyname,
576df0
-                                                proxyport, server_portstr,
576df0
-                                                sizeof(server_portstr))) != OK)
576df0
-            break;
576df0
+            /* Step One (again): (Re)Determine Who To Connect To */
576df0
+            if ((status = ap_proxy_determine_connection(p, r, conf, worker,
576df0
+                            backend, uri, &newurl, proxyname, proxyport,
576df0
+                            req->server_portstr, sizeof(req->server_portstr))))
576df0
+                break;
576df0
+
576df0
+            /* The code assumes locurl is not changed during the loop, or
576df0
+             * ap_proxy_http_prefetch() would have to be called every time,
576df0
+             * and header_brigade be changed accordingly...
576df0
+             */
576df0
+            AP_DEBUG_ASSERT(strcmp(newurl, locurl) == 0);
576df0
+        }
576df0
 
576df0
         /* Step Two: Make the Connection */
576df0
         if (ap_proxy_check_connection(proxy_function, backend, r->server, 1,
576df0
@@ -1972,54 +2101,64 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
576df0
         }
576df0
 
576df0
         /* Step Three: Create conn_rec */
576df0
-        if (!backend->connection) {
576df0
-            if ((status = ap_proxy_connection_create_ex(proxy_function,
576df0
-                                                        backend, r)) != OK)
576df0
-                break;
576df0
-            /*
576df0
-             * On SSL connections set a note on the connection what CN is
576df0
-             * requested, such that mod_ssl can check if it is requested to do
576df0
-             * so.
576df0
-             */
576df0
-            if (backend->ssl_hostname) {
576df0
-                apr_table_setn(backend->connection->notes,
576df0
-                               "proxy-request-hostname",
576df0
-                               backend->ssl_hostname);
576df0
-            }
576df0
+        if ((status = ap_proxy_connection_create_ex(proxy_function,
576df0
+                                                    backend, r)) != OK)
576df0
+            break;
576df0
+        req->origin = backend->connection;
576df0
+
576df0
+        /* Don't recycle the connection if prefetch (above) told not to do so */
576df0
+        if (toclose) {
576df0
+            backend->close = 1;
576df0
+            req->origin->keepalive = AP_CONN_CLOSE;
576df0
+        }
576df0
+
576df0
+        /*
576df0
+         * On SSL connections set a note on the connection what CN is
576df0
+         * requested, such that mod_ssl can check if it is requested to do
576df0
+         * so.
576df0
+         *
576df0
+         * https://github.com/apache/httpd/commit/7d272e2628b4ae05f68cdc74b070707250896a34
576df0
+         */
576df0
+        if (backend->ssl_hostname) {
576df0
+            apr_table_setn(backend->connection->notes,
576df0
+                           "proxy-request-hostname",
576df0
+                           backend->ssl_hostname);
576df0
         }
576df0
 
576df0
         /* Step Four: Send the Request
576df0
          * On the off-chance that we forced a 100-Continue as a
576df0
          * kinda HTTP ping test, allow for retries
576df0
          */
576df0
-        if ((status = ap_proxy_http_request(p, r, backend, worker,
576df0
-                                        conf, uri, locurl, server_portstr)) != OK) {
576df0
-            if ((status == HTTP_SERVICE_UNAVAILABLE) && worker->s->ping_timeout_set) {
576df0
-                backend->close = 1;
576df0
+        status = ap_proxy_http_request(req);
576df0
+        if (status != OK) {
576df0
+            if (req->do_100_continue && status == HTTP_SERVICE_UNAVAILABLE) {
576df0
                 ap_log_rerror(APLOG_MARK, APLOG_INFO, status, r, APLOGNO(01115)
576df0
                               "HTTP: 100-Continue failed to %pI (%s)",
576df0
                               worker->cp->addr, worker->s->hostname_ex);
576df0
+                backend->close = 1;
576df0
                 retry++;
576df0
                 continue;
576df0
-            } else {
576df0
-                break;
576df0
-            }
576df0
+            } 
576df0
 
576df0
+            break;
576df0
         }
576df0
 
576df0
         /* Step Five: Receive the Response... Fall thru to cleanup */
576df0
-        status = ap_proxy_http_process_response(p, r, &backend, worker,
576df0
-                                                conf, server_portstr);
576df0
+        status = ap_proxy_http_process_response(req);
576df0
 
576df0
         break;
576df0
     }
576df0
 
576df0
     /* Step Six: Clean Up */
576df0
 cleanup:
576df0
-    if (backend) {
576df0
+    if (req->backend) {
576df0
         if (status != OK)
576df0
-            backend->close = 1;
576df0
-        ap_proxy_http_cleanup(proxy_function, r, backend);
576df0
+            req->backend->close = 1;
576df0
+        ap_proxy_http_cleanup(proxy_function, r, req->backend);
576df0
+    }
576df0
+    if (req->expecting_100) {
576df0
+        /* Restore r->expecting_100 if we didn't touch it */
576df0
+        r->expecting_100 = req->expecting_100;
576df0
     }
576df0
     return status;
576df0
 }
576df0
diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c
576df0
index c5d4f8e..e1253e4 100644
576df0
--- a/modules/proxy/mod_proxy_uwsgi.c
576df0
+++ b/modules/proxy/mod_proxy_uwsgi.c
576df0
@@ -509,12 +509,11 @@ static int uwsgi_handler(request_rec *r, proxy_worker * worker,
576df0
     }
576df0
 
576df0
     /* Step Three: Create conn_rec */
576df0
-    if (!backend->connection) {
576df0
-        if ((status = ap_proxy_connection_create(UWSGI_SCHEME, backend,
576df0
-                                                 r->connection,
576df0
-                                                 r->server)) != OK)
576df0
-            goto cleanup;
576df0
-    }
576df0
+    if ((status = ap_proxy_connection_create(UWSGI_SCHEME, backend,
576df0
+                                             r->connection,
576df0
+                                             r->server)) != OK)
576df0
+        goto cleanup;
576df0
+
576df0
 
576df0
     /* Step Four: Process the Request */
576df0
     if (((status = ap_setup_client_block(r, REQUEST_CHUNKED_ERROR)) != OK)
576df0
diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c
576df0
index 9dda010..4aadbab 100644
576df0
--- a/modules/proxy/mod_proxy_wstunnel.c
576df0
+++ b/modules/proxy/mod_proxy_wstunnel.c
576df0
@@ -284,8 +284,8 @@ static int proxy_wstunnel_handler(request_rec *r, proxy_worker *worker,
576df0
     char server_portstr[32];
576df0
     proxy_conn_rec *backend = NULL;
576df0
     char *scheme;
576df0
-    int retry;
576df0
     apr_pool_t *p = r->pool;
576df0
+    char *locurl = url;
576df0
     apr_uri_t *uri;
576df0
     int is_ssl = 0;
576df0
     const char *upgrade_method = *worker->s->upgrade ? worker->s->upgrade : "WebSocket";
576df0
@@ -318,59 +318,51 @@ static int proxy_wstunnel_handler(request_rec *r, proxy_worker *worker,
576df0
     ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02451) "serving URL %s", url);
576df0
 
576df0
     /* create space for state information */
576df0
-    status = ap_proxy_acquire_connection(scheme, &backend, worker,
576df0
-                                         r->server);
576df0
+    status = ap_proxy_acquire_connection(scheme, &backend, worker, r->server);
576df0
     if (status != OK) {
576df0
-        if (backend) {
576df0
-            backend->close = 1;
576df0
-            ap_proxy_release_connection(scheme, backend, r->server);
576df0
-        }
576df0
-        return status;
576df0
+        goto cleanup;
576df0
     }
576df0
 
576df0
     backend->is_ssl = is_ssl;
576df0
     backend->close = 0;
576df0
 
576df0
-    retry = 0;
576df0
-    while (retry < 2) {
576df0
-        char *locurl = url;
576df0
-        /* Step One: Determine Who To Connect To */
576df0
-        status = ap_proxy_determine_connection(p, r, conf, worker, backend,
576df0
-                                               uri, &locurl, proxyname, proxyport,
576df0
-                                               server_portstr,
576df0
-                                               sizeof(server_portstr));
576df0
-
576df0
-        if (status != OK)
576df0
-            break;
576df0
-
576df0
-        /* Step Two: Make the Connection */
576df0
-        if (ap_proxy_connect_backend(scheme, backend, worker, r->server)) {
576df0
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02452)
576df0
-                          "failed to make connection to backend: %s",
576df0
-                          backend->hostname);
576df0
-            status = HTTP_SERVICE_UNAVAILABLE;
576df0
-            break;
576df0
-        }
576df0
-
576df0
-        /* Step Three: Create conn_rec */
576df0
-        if (!backend->connection) {
576df0
-            status = ap_proxy_connection_create_ex(scheme, backend, r);
576df0
-            if (status  != OK) {
576df0
-                break;
576df0
-            }
576df0
-        }
576df0
-
576df0
-        backend->close = 1; /* must be after ap_proxy_determine_connection */
576df0
-
576df0
+    /* Step One: Determine Who To Connect To */
576df0
+    status = ap_proxy_determine_connection(p, r, conf, worker, backend,
576df0
+                                           uri, &locurl, proxyname, proxyport,
576df0
+                                           server_portstr,
576df0
+                                           sizeof(server_portstr));
576df0
+    
576df0
+    if (status != OK) {
576df0
+        goto cleanup;
576df0
+    }
576df0
+    
576df0
+    /* Step Two: Make the Connection */
576df0
+    if (ap_proxy_connect_backend(scheme, backend, worker, r->server)) {
576df0
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02452)
576df0
+                      "failed to make connection to backend: %s",
576df0
+                      backend->hostname);
576df0
+        status = HTTP_SERVICE_UNAVAILABLE;
576df0
+        goto cleanup;
576df0
+    }
576df0
 
576df0
-        /* Step Three: Process the Request */
576df0
-        status = proxy_wstunnel_request(p, r, backend, worker, conf, uri, locurl,
576df0
-                                      server_portstr);
576df0
-        break;
576df0
+    /* Step Three: Create conn_rec */
576df0
+    /* keep it because of */
576df0
+    /* https://github.com/apache/httpd/commit/313d5ee40f390da1a6ee2c2752864ad3aad0a1c3 */
576df0
+    status = ap_proxy_connection_create_ex(scheme, backend, r);
576df0
+    if (status != OK) {
576df0
+        goto cleanup;
576df0
     }
576df0
+    
576df0
+    /* Step Four: Process the Request */
576df0
+    status = proxy_wstunnel_request(p, r, backend, worker, conf, uri, locurl,
576df0
+                                  server_portstr);
576df0
 
576df0
+cleanup:
576df0
     /* Do not close the socket */
576df0
-    ap_proxy_release_connection(scheme, backend, r->server);
576df0
+    if (backend) {
576df0
+        backend->close = 1;
576df0
+        ap_proxy_release_connection(scheme, backend, r->server);
576df0
+    }
576df0
     return status;
576df0
 }
576df0
 
576df0
diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
576df0
index 0bbfa59..0759dac 100644
576df0
--- a/modules/proxy/proxy_util.c
576df0
+++ b/modules/proxy/proxy_util.c
576df0
@@ -3573,10 +3573,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
576df0
      * To be compliant, we only use 100-Continue for requests with bodies.
576df0
      * We also make sure we won't be talking HTTP/1.0 as well.
576df0
      */
576df0
-    do_100_continue = (worker->s->ping_timeout_set
576df0
-                       && ap_request_has_body(r)
576df0
-                       && (PROXYREQ_REVERSE == r->proxyreq)
576df0
-                       && !(apr_table_get(r->subprocess_env, "force-proxy-request-1.0")));
576df0
+    do_100_continue = PROXY_DO_100_CONTINUE(worker, r);
576df0
 
576df0
     if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) {
576df0
         /*
576df0
@@ -3593,7 +3590,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
576df0
         buf = apr_pstrcat(p, r->method, " ", url, " HTTP/1.1" CRLF, NULL);
576df0
     }
576df0
     if (apr_table_get(r->subprocess_env, "proxy-nokeepalive")) {
576df0
-        origin->keepalive = AP_CONN_CLOSE;
576df0
+        if (origin) {
576df0
+            origin->keepalive = AP_CONN_CLOSE;
576df0
+        }
576df0
         p_conn->close = 1;
576df0
     }
576df0
     ap_xlate_proto_to_ascii(buf, strlen(buf));
576df0
@@ -3685,14 +3684,6 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
576df0
     if (do_100_continue) {
576df0
         const char *val;
576df0
 
576df0
-        if (!r->expecting_100) {
576df0
-            /* Don't forward any "100 Continue" response if the client is
576df0
-             * not expecting it.
576df0
-             */
576df0
-            apr_table_setn(r->subprocess_env, "proxy-interim-response",
576df0
-                                              "Suppress");
576df0
-        }
576df0
-
576df0
         /* Add the Expect header if not already there. */
576df0
         if (((val = apr_table_get(r->headers_in, "Expect")) == NULL)
576df0
                 || (strcasecmp(val, "100-Continue") != 0 /* fast path */
576df0
diff --git a/server/protocol.c b/server/protocol.c
576df0
index 8d90055..8d1fdd2 100644
576df0
--- a/server/protocol.c
576df0
+++ b/server/protocol.c
576df0
@@ -2188,21 +2188,23 @@ AP_DECLARE(void) ap_send_interim_response(request_rec *r, int send_headers)
576df0
                       "Status is %d - not sending interim response", r->status);
576df0
         return;
576df0
     }
576df0
-    if ((r->status == HTTP_CONTINUE) && !r->expecting_100) {
576df0
-        /*
576df0
-         * Don't send 100-Continue when there was no Expect: 100-continue
576df0
-         * in the request headers. For origin servers this is a SHOULD NOT
576df0
-         * for proxies it is a MUST NOT according to RFC 2616 8.2.3
576df0
-         */
576df0
-        return;
576df0
-    }
576df0
+    if (r->status == HTTP_CONTINUE) {
576df0
+        if (!r->expecting_100) {
576df0
+            /*
576df0
+             * Don't send 100-Continue when there was no Expect: 100-continue
576df0
+             * in the request headers. For origin servers this is a SHOULD NOT
576df0
+             * for proxies it is a MUST NOT according to RFC 2616 8.2.3
576df0
+             */
576df0
+            return;
576df0
+        }
576df0
 
576df0
-    /* if we send an interim response, we're no longer in a state of
576df0
-     * expecting one.  Also, this could feasibly be in a subrequest,
576df0
-     * so we need to propagate the fact that we responded.
576df0
-     */
576df0
-    for (rr = r; rr != NULL; rr = rr->main) {
576df0
-        rr->expecting_100 = 0;
576df0
+        /* if we send an interim response, we're no longer in a state of
576df0
+         * expecting one.  Also, this could feasibly be in a subrequest,
576df0
+         * so we need to propagate the fact that we responded.
576df0
+         */
576df0
+        for (rr = r; rr != NULL; rr = rr->main) {
576df0
+            rr->expecting_100 = 0;
576df0
+        }
576df0
     }
576df0
 
576df0
     status_line = apr_pstrcat(r->pool, AP_SERVER_PROTOCOL, " ", r->status_line, CRLF, NULL);