#10983: fix several bugs in the _tunnel implementation that seem to have missed while porting between branches.  A unittest is needed!
diff --git a/Lib/http/client.py b/Lib/http/client.py
index 347aa61..36b7349 100644
--- a/Lib/http/client.py
+++ b/Lib/http/client.py
@@ -653,6 +653,7 @@
         self._method = None
         self._tunnel_host = None
         self._tunnel_port = None
+        self._tunnel_headers = {}
 
         self._set_hostport(host, port)
 
@@ -691,15 +692,16 @@
 
     def _tunnel(self):
         self._set_hostport(self._tunnel_host, self._tunnel_port)
-        connect_str = "CONNECT %s:%d HTTP/1.0\r\n" %(self.host, self.port)
+        connect_str = "CONNECT %s:%d HTTP/1.0\r\n" % (self.host, self.port)
         connect_bytes = connect_str.encode("ascii")
         self.send(connect_bytes)
-        for header, value in self._tunnel_headers.iteritems():
+        for header, value in self._tunnel_headers.items():
             header_str = "%s: %s\r\n" % (header, value)
             header_bytes = header_str.encode("latin1")
             self.send(header_bytes)
+        self.send(b'\r\n')
 
-        response = self.response_class(self.sock, method = self._method)
+        response = self.response_class(self.sock, method=self._method)
         (version, code, message) = response._read_status()
 
         if code != 200: