Use http_Unset for a header instead of moving backwards a pointer.

Provide test case for bug #1684.

bin/varnishd/cache/cache_fetch.c

@@ -269,8 +269,10 @@ vbf_stp_startfetch(struct worker *wrk, struct busyobj *bo)
 	else
 		AZ(bo->req);
 
+	if (bo->retries > 0)
+		http_Unset(bo->bereq, "\012X-Varnish:");
+
 	http_PrintfHeader(bo->bereq, "X-Varnish: %u", VXID(bo->vsl->wid));
-	bo->bereq->nhd--;
 
 	VCL_backend_fetch_method(bo->vcl, wrk, NULL, bo, bo->bereq->ws);
 

bin/varnishtest/tests/r01684.vtc

+varnishtest  "Regression test for #1684"
+server s1 {
+        rxreq
+        txresp -hdr "foo: 1"
+        accept
+        rxreq
+        txresp -hdr "foo: 2"
+        accept
+        rxreq
+        txresp -hdr "foo: 3"
+} -start
+
+varnish v1 -vcl+backend {
+        sub vcl_recv { return (pass); }
+        sub vcl_backend_response {
+                set beresp.http.bar = bereq.retries;
+                if (beresp.http.foo != bereq.http.stop) {
+                        return (retry);
+                }
+        }
+} -start
+
+# check log for the aborted POST
+logexpect l1 -v v1 {
+	expect * =	BereqHeader "^X-Varnish:"
+	expect * =	BereqUnset	"^X-Varnish:"
+	expect * =	BereqHeader	"^X-Varnish"
+} -start
+
+varnish v1 -cliok "param.set debug +syncvsl"
+varnish v1 -cliok "param.set max_retries 2"
+
+client c1 {
+        txreq -hdr "stop: 3"
+        rxresp
+        expect resp.http.foo == 3
+} -run
+