Index: httpd-2.2.34/modules/proxy/mod_proxy_wstunnel.c
===================================================================
--- httpd-2.2.34.orig/modules/proxy/mod_proxy_wstunnel.c
+++ httpd-2.2.34/modules/proxy/mod_proxy_wstunnel.c
@@ -65,12 +65,14 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbr
                                             char **old_cl_val,
                                             char **old_te_val)
 {
+    int rc = OK;
     conn_rec *c = r->connection;
     int counter;
     char *buf;
+    apr_table_t *saved_headers_in = r->headers_in;
+    const char *saved_host = apr_table_get(saved_headers_in, "Host");
     const apr_array_header_t *headers_in_array;
     const apr_table_entry_t *headers_in;
-    apr_table_t *headers_in_copy;
     apr_bucket *e;
     int do_100_continue;
     conn_rec *origin = p_conn->connection;
@@ -102,12 +104,57 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbr
         buf = apr_pstrcat(p, r->method, " ", url, " HTTP/1.1" CRLF, NULL);
     }
     if (apr_table_get(r->subprocess_env, "proxy-nokeepalive")) {
-        origin->keepalive = AP_CONN_CLOSE;
+        if (origin) {
+            origin->keepalive = AP_CONN_CLOSE;
+        }
         p_conn->close = 1;
     }
     ap_xlate_proto_to_ascii(buf, strlen(buf));
     e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
     APR_BRIGADE_INSERT_TAIL(header_brigade, e);
+
+    /*
+     * Make a copy on r->headers_in for the request we make to the backend,
+     * modify the copy in place according to our configuration and connection
+     * handling, use it to fill in the forwarded headers' brigade, and finally
+     * restore the saved/original ones in r->headers_in.
+     *
+     * Note: We need to take r->pool for apr_table_copy as the key / value
+     * pairs in r->headers_in have been created out of r->pool and
+     * p might be (and actually is) a longer living pool.
+     * This would trigger the bad pool ancestry abort in apr_table_copy if
+     * apr is compiled with APR_POOL_DEBUG.
+     *
+     * icing: if p indeed lives longer than r->pool, we should allocate
+     * all new header values from r->pool as well and avoid leakage.
+     */
+    r->headers_in = apr_table_copy(r->pool, saved_headers_in);
+
+    /* Return the original Transfer-Encoding and/or Content-Length values
+     * then drop the headers, they must be set by the proxy handler based
+     * on the actual body being forwarded.
+     */
+    if ((*old_te_val = (char *)apr_table_get(r->headers_in,
+                                             "Transfer-Encoding"))) {
+        apr_table_unset(r->headers_in, "Transfer-Encoding");
+    }
+    if ((*old_cl_val = (char *)apr_table_get(r->headers_in,
+                                             "Content-Length"))) {
+        apr_table_unset(r->headers_in, "Content-Length");
+    }
+
+    /* Clear out hop-by-hop request headers not to forward */
+    proxy_clear_connection(r->pool, r->headers_in);
+
+    /* RFC2616 13.5.1 says we should strip these */
+    apr_table_unset(r->headers_in, "Keep-Alive");
+    apr_table_unset(r->headers_in, "Upgrade");
+    apr_table_unset(r->headers_in, "Trailer");
+    apr_table_unset(r->headers_in, "TE");
+
+    /* We used to send `Host: ` always first, so let's keep it that
+     * way. No telling which legacy backend is relying no this.
+     */
     if (conf->preserve_host == 0) {
         if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */
             if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) {
@@ -129,7 +176,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbr
         /* don't want to use r->hostname, as the incoming header might have a
          * port attached
          */
-        const char* hostname = apr_table_get(r->headers_in,"Host");
+        const char* hostname = saved_host;
         if (!hostname) {
             hostname =  r->server->server_hostname;
             ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, "AH01092: "
@@ -143,6 +190,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbr
     ap_xlate_proto_to_ascii(buf, strlen(buf));
     e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
     APR_BRIGADE_INSERT_TAIL(header_brigade, e);
+    apr_table_unset(r->headers_in, "Host");
 
     /* handle Via */
     if (conf->viaopt == via_block) {
@@ -198,12 +246,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbr
      *
      * The HTTP/1.1 Via: header is designed for passing client
      * information through proxies to a server, and should be used in
-     * a forward proxy configuation instead of X-Forwarded-*. See the
+     * a forward proxy configuration instead of X-Forwarded-*. See the
      * ProxyVia option for details.
      */
     if (PROXYREQ_REVERSE == r->proxyreq) {
-        const char *buf;
-
         /* Add X-Forwarded-For: so that the upstream has a chance to
          * determine, where the original request came from.
          */
@@ -213,8 +259,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbr
         /* Add X-Forwarded-Host: so that upstream knows what the
          * original request hostname was.
          */
-        if ((buf = apr_table_get(r->headers_in, "Host"))) {
-            apr_table_mergen(r->headers_in, "X-Forwarded-Host", buf);
+        if (saved_host) {
+            apr_table_mergen(r->headers_in, "X-Forwarded-Host",
+                             saved_host);
         }
 
         /* Add X-Forwarded-Server: so that upstream knows what the
@@ -225,76 +272,37 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbr
                          r->server->server_hostname);
     }
 
-    proxy_run_fixups(r);
-    /*
-     * Make a copy of the headers_in table before clearing the connection
-     * headers as we need the connection headers later in the http output
-     * filter to prepare the correct response headers.
-     *
-     * Note: We need to take r->pool for apr_table_copy as the key / value
-     * pairs in r->headers_in have been created out of r->pool and
-     * p might be (and actually is) a longer living pool.
-     * This would trigger the bad pool ancestry abort in apr_table_copy if
-     * apr is compiled with APR_POOL_DEBUG.
+    /* Do we want to strip Proxy-Authorization ?
+     * If we haven't used it, then NO
+     * If we have used it then MAYBE: RFC2616 says we MAY propagate it.
+     * So let's make it configurable by env.
      */
-    headers_in_copy = apr_table_copy(r->pool, r->headers_in);
-    proxy_clear_connection(p, headers_in_copy);
+    if (r->user != NULL /* we've authenticated */
+        && !apr_table_get(r->subprocess_env, "Proxy-Chain-Auth")) {
+        apr_table_unset(r->headers_in, "Proxy-Authorization");
+    }
+
+    /* for sub-requests, ignore freshness/expiry headers */
+    if (r->main) {
+        apr_table_unset(r->headers_in, "If-Match");
+        apr_table_unset(r->headers_in, "If-Modified-Since");
+        apr_table_unset(r->headers_in, "If-Range");
+        apr_table_unset(r->headers_in, "If-Unmodified-Since");
+        apr_table_unset(r->headers_in, "If-None-Match");
+    }
+
+    /* run hook to fixup the request we are about to send */
+    proxy_run_fixups(r);
+
     /* send request headers */
-    headers_in_array = apr_table_elts(headers_in_copy);
+    headers_in_array = apr_table_elts(r->headers_in);
     headers_in = (const apr_table_entry_t *) headers_in_array->elts;
     for (counter = 0; counter < headers_in_array->nelts; counter++) {
         if (headers_in[counter].key == NULL
-            || headers_in[counter].val == NULL
-
-            /* Already sent */
-            || !strcasecmp(headers_in[counter].key, "Host")
-
-            /* Clear out hop-by-hop request headers not to send
-             * RFC2616 13.5.1 says we should strip these headers
-             */
-            || !strcasecmp(headers_in[counter].key, "Keep-Alive")
-            || !strcasecmp(headers_in[counter].key, "TE")
-            || !strcasecmp(headers_in[counter].key, "Trailer")
-            || !strcasecmp(headers_in[counter].key, "Upgrade")
-
-            ) {
-            continue;
-        }
-        /* Do we want to strip Proxy-Authorization ?
-         * If we haven't used it, then NO
-         * If we have used it then MAYBE: RFC2616 says we MAY propagate it.
-         * So let's make it configurable by env.
-         */
-        if (!strcasecmp(headers_in[counter].key,"Proxy-Authorization")) {
-            if (r->user != NULL) { /* we've authenticated */
-                if (!apr_table_get(r->subprocess_env, "Proxy-Chain-Auth")) {
-                    continue;
-                }
-            }
-        }
-
-        /* Skip Transfer-Encoding and Content-Length for now.
-         */
-        if (!strcasecmp(headers_in[counter].key, "Transfer-Encoding")) {
-            *old_te_val = headers_in[counter].val;
-            continue;
-        }
-        if (!strcasecmp(headers_in[counter].key, "Content-Length")) {
-            *old_cl_val = headers_in[counter].val;
+            || headers_in[counter].val == NULL) {
             continue;
         }
 
-        /* for sub-requests, ignore freshness/expiry headers */
-        if (r->main) {
-            if (    !strcasecmp(headers_in[counter].key, "If-Match")
-                || !strcasecmp(headers_in[counter].key, "If-Modified-Since")
-                || !strcasecmp(headers_in[counter].key, "If-Range")
-                || !strcasecmp(headers_in[counter].key, "If-Unmodified-Since")
-                || !strcasecmp(headers_in[counter].key, "If-None-Match")) {
-                continue;
-            }
-        }
-
         buf = apr_pstrcat(p, headers_in[counter].key, ": ",
                           headers_in[counter].val, CRLF,
                           NULL);
@@ -302,6 +310,8 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbr
         e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
         APR_BRIGADE_INSERT_TAIL(header_brigade, e);
     }
+
+    r->headers_in = saved_headers_in;
     return OK;
 }
 
Index: httpd-2.2.34/modules/proxy/mod_proxy_http.c
===================================================================
--- httpd-2.2.34.orig/modules/proxy/mod_proxy_http.c
+++ httpd-2.2.34/modules/proxy/mod_proxy_http.c
@@ -684,6 +684,16 @@ static int spool_reqbody_cl(apr_pool_t *
     return(pass_brigade(bucket_alloc, r, p_conn, origin, header_brigade, 1));
 }
 
+static void proxy_clear_connection(apr_pool_t *p, apr_table_t *headers)
+{
+    header_dptr x;
+    x.pool = p;
+    x.table = headers;
+    apr_table_unset(headers, "Proxy-Connection");
+    apr_table_do(clear_conn_headers, &x, headers, "Connection", NULL);
+    apr_table_unset(headers, "Connection");
+}
+
 static
 int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
                                    proxy_conn_rec *p_conn, conn_rec *origin,
@@ -691,6 +701,7 @@ int ap_proxy_http_request(apr_pool_t *p,
                                    apr_uri_t *uri,
                                    char *url, char *server_portstr)
 {
+    int rc = OK;
     conn_rec *c = r->connection;
     apr_bucket_alloc_t *bucket_alloc = c->bucket_alloc;
     apr_bucket_brigade *header_brigade;
@@ -698,8 +709,9 @@ int ap_proxy_http_request(apr_pool_t *p,
     apr_bucket_brigade *temp_brigade;
     apr_bucket *e;
     char *buf;
+    apr_table_t *saved_headers_in = r->headers_in;
+    const char *saved_host = apr_table_get(saved_headers_in, "Host");
     const apr_array_header_t *headers_in_array;
-    const apr_table_entry_t *headers_in;
     int counter;
     apr_status_t status;
     enum rb_methods {RB_INIT, RB_STREAM_CL, RB_STREAM_CHUNKED, RB_SPOOL_CL};
@@ -709,7 +721,7 @@ int ap_proxy_http_request(apr_pool_t *p,
     apr_off_t bytes_read = 0;
     apr_off_t bytes;
     int force10, rv;
-    apr_table_t *headers_in_copy;
+    const apr_table_entry_t *headers_in;
 
     header_brigade = apr_brigade_create(p, bucket_alloc);
 
@@ -734,12 +746,58 @@ int ap_proxy_http_request(apr_pool_t *p,
         force10 = 0;
     }
     if (apr_table_get(r->subprocess_env, "proxy-nokeepalive")) {
-        origin->keepalive = AP_CONN_CLOSE;
+	if (origin) {
+            origin->keepalive = AP_CONN_CLOSE;
+        }
         p_conn->close++;
     }
     ap_xlate_proto_to_ascii(buf, strlen(buf));
     e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
     APR_BRIGADE_INSERT_TAIL(header_brigade, e);
+
+    /*
+     * Make a copy on r->headers_in for the request we make to the backend,
+     * modify the copy in place according to our configuration and connection
+     * handling, use it to fill in the forwarded headers' brigade, and finally
+     * restore the saved/original ones in r->headers_in.
+     *
+     * Note: We need to take r->pool for apr_table_copy as the key / value
+     * pairs in r->headers_in have been created out of r->pool and
+     * p might be (and actually is) a longer living pool.
+     * This would trigger the bad pool ancestry abort in apr_table_copy if
+     * apr is compiled with APR_POOL_DEBUG.
+     *
+     * icing: if p indeed lives longer than r->pool, we should allocate
+     * all new header values from r->pool as well and avoid leakage.
+     */
+    r->headers_in = apr_table_copy(r->pool, saved_headers_in);
+
+    /* Return the original Transfer-Encoding and/or Content-Length values
+     * then drop the headers, they must be set by the proxy handler based
+     * on the actual body being forwarded.
+     */
+    if ((old_te_val = (char *)apr_table_get(r->headers_in,
+                                             "Transfer-Encoding"))) {
+        apr_table_unset(r->headers_in, "Transfer-Encoding");
+    }
+    if ((old_cl_val = (char *)apr_table_get(r->headers_in,
+                                             "Content-Length"))) {
+        apr_table_unset(r->headers_in, "Content-Length");
+    }
+
+    /* Clear out hop-by-hop request headers not to forward */
+    proxy_clear_connection(r->pool, r->headers_in);
+
+    /* RFC2616 13.5.1 says we should strip these */
+    apr_table_unset(r->headers_in, "Keep-Alive");
+    apr_table_unset(r->headers_in, "Upgrade");
+    apr_table_unset(r->headers_in, "Trailer");
+    apr_table_unset(r->headers_in, "TE");
+
+    /* We used to send `Host: ` always first, so let's keep it that
+     * way. No telling which legacy backend is relying no this.
+     */
+
     if (conf->preserve_host == 0) {
         if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */
             if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) {
@@ -761,7 +819,7 @@ int ap_proxy_http_request(apr_pool_t *p,
         /* don't want to use r->hostname, as the incoming header might have a
          * port attached
          */
-        const char* hostname = apr_table_get(r->headers_in,"Host");
+        const char* hostname = saved_host;
         if (!hostname) {
             hostname =  r->server->server_hostname;
             ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,
@@ -776,6 +834,7 @@ int ap_proxy_http_request(apr_pool_t *p,
     ap_xlate_proto_to_ascii(buf, strlen(buf));
     e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
     APR_BRIGADE_INSERT_TAIL(header_brigade, e);
+    apr_table_unset(r->headers_in, "Host");
 
     /* handle Via */
     if (conf->viaopt == via_block) {
@@ -828,8 +887,6 @@ int ap_proxy_http_request(apr_pool_t *p,
      */
 
     if (PROXYREQ_REVERSE == r->proxyreq) {
-        const char *buf;
-
         /* Add X-Forwarded-For: so that the upstream has a chance to
          * determine, where the original request came from.
          */
@@ -839,8 +896,9 @@ int ap_proxy_http_request(apr_pool_t *p,
         /* Add X-Forwarded-Host: so that upstream knows what the
          * original request hostname was.
          */
-        if ((buf = apr_table_get(r->headers_in, "Host"))) {
-            apr_table_mergen(r->headers_in, "X-Forwarded-Host", buf);
+        if (saved_host) {
+            apr_table_mergen(r->headers_in, "X-Forwarded-Host",
+                             saved_host);
         }
 
         /* Add X-Forwarded-Server: so that upstream knows what the
@@ -851,76 +909,37 @@ int ap_proxy_http_request(apr_pool_t *p,
                          r->server->server_hostname);
     }
 
-    proxy_run_fixups(r);
-    /*
-     * Make a copy of the headers_in table before clearing the connection
-     * headers as we need the connection headers later in the http output
-     * filter to prepare the correct response headers.
-     *
-     * Note: We need to take r->pool for apr_table_copy as the key / value
-     * pairs in r->headers_in have been created out of r->pool and
-     * p might be (and actually is) a longer living pool.
-     * This would trigger the bad pool ancestry abort in apr_table_copy if
-     * apr is compiled with APR_POOL_DEBUG.
+    /* Do we want to strip Proxy-Authorization ?
+     * If we haven't used it, then NO
+     * If we have used it then MAYBE: RFC2616 says we MAY propagate it.
+     * So let's make it configurable by env.
      */
-    headers_in_copy = apr_table_copy(r->pool, r->headers_in);
-    ap_proxy_clear_connection(p, headers_in_copy);
+    if (r->user != NULL /* we've authenticated */
+        && !apr_table_get(r->subprocess_env, "Proxy-Chain-Auth")) {
+        apr_table_unset(r->headers_in, "Proxy-Authorization");
+    }
+
+    /* for sub-requests, ignore freshness/expiry headers */
+    if (r->main) {
+        apr_table_unset(r->headers_in, "If-Match");
+        apr_table_unset(r->headers_in, "If-Modified-Since");
+        apr_table_unset(r->headers_in, "If-Range");
+        apr_table_unset(r->headers_in, "If-Unmodified-Since");
+        apr_table_unset(r->headers_in, "If-None-Match");
+    }
+
+    /* run hook to fixup the request we are about to send */
+    proxy_run_fixups(r);
+
     /* send request headers */
-    headers_in_array = apr_table_elts(headers_in_copy);
+    headers_in_array = apr_table_elts(r->headers_in);
     headers_in = (const apr_table_entry_t *) headers_in_array->elts;
     for (counter = 0; counter < headers_in_array->nelts; counter++) {
         if (headers_in[counter].key == NULL
-             || headers_in[counter].val == NULL
-
-            /* Already sent */
-             || !strcasecmp(headers_in[counter].key, "Host")
-
-            /* Clear out hop-by-hop request headers not to send
-             * RFC2616 13.5.1 says we should strip these headers
-             */
-             || !strcasecmp(headers_in[counter].key, "Keep-Alive")
-             || !strcasecmp(headers_in[counter].key, "TE")
-             || !strcasecmp(headers_in[counter].key, "Trailer")
-             || !strcasecmp(headers_in[counter].key, "Upgrade")
-
-             ) {
-            continue;
-        }
-        /* Do we want to strip Proxy-Authorization ?
-         * If we haven't used it, then NO
-         * If we have used it then MAYBE: RFC2616 says we MAY propagate it.
-         * So let's make it configurable by env.
-         */
-        if (!strcasecmp(headers_in[counter].key,"Proxy-Authorization")) {
-            if (r->user != NULL) { /* we've authenticated */
-                if (!apr_table_get(r->subprocess_env, "Proxy-Chain-Auth")) {
-                    continue;
-                }
-            }
-        }
-
-        /* Skip Transfer-Encoding and Content-Length for now.
-         */
-        if (!strcasecmp(headers_in[counter].key, "Transfer-Encoding")) {
-            old_te_val = headers_in[counter].val;
-            continue;
-        }
-        if (!strcasecmp(headers_in[counter].key, "Content-Length")) {
-            old_cl_val = headers_in[counter].val;
+            || headers_in[counter].val == NULL) {
             continue;
         }
 
-        /* for sub-requests, ignore freshness/expiry headers */
-        if (r->main) {
-            if (    !strcasecmp(headers_in[counter].key, "If-Match")
-                 || !strcasecmp(headers_in[counter].key, "If-Modified-Since")
-                 || !strcasecmp(headers_in[counter].key, "If-Range")
-                 || !strcasecmp(headers_in[counter].key, "If-Unmodified-Since")
-                 || !strcasecmp(headers_in[counter].key, "If-None-Match")) {
-                continue;
-            }
-        }
-
         buf = apr_pstrcat(p, headers_in[counter].key, ": ",
                           headers_in[counter].val, CRLF,
                           NULL);
@@ -1167,6 +1186,7 @@ skip_body:
         return rv;
     }
 
+    r->headers_in = saved_headers_in;
     return OK;
 }
 
