rugged 0.19.0 → 0.28.0

data/vendor/libgit2/src/transports/winhttp.c

@@ -5,6 +5,8 @@
  * a Linking Exception. For full terms see the included COPYING file.
  */
 
+#include "common.h"
+
 #ifdef GIT_WINHTTP
 
 #include "git2.h"
@@ -15,14 +17,15 @@
 #include "smart.h"
 #include "remote.h"
 #include "repository.h"
+#include "global.h"
+#include "http.h"
 
+#include <wincrypt.h>
 #include <winhttp.h>
-#pragma comment(lib, "winhttp")
-
-#include <strsafe.h>
 
-/* For UuidCreate */
-#pragma comment(lib, "rpcrt4")
+/* For IInternetSecurityManager zone check */
+#include <objbase.h>
+#include <urlmon.h>
 
 #define WIDEN2(s) L ## s
 #define WIDEN(s) WIDEN2(s)
@@ -31,8 +34,20 @@
 #define WINHTTP_OPTION_PEERDIST_EXTENSION_STATE	109
 #define CACHED_POST_BODY_BUF_SIZE	4096
 #define UUID_LENGTH_CCH	32
+#define TIMEOUT_INFINITE -1
+#define DEFAULT_CONNECT_TIMEOUT 60000
+#ifndef WINHTTP_IGNORE_REQUEST_TOTAL_LENGTH
+#define WINHTTP_IGNORE_REQUEST_TOTAL_LENGTH 0
+#endif
+
+#ifndef WINHTTP_FLAG_SECURE_PROTOCOL_TLS_1_1
+# define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 0x00000200
+#endif
+
+#ifndef WINHTTP_FLAG_SECURE_PROTOCOL_TLS_1_2
+# define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2 0x00000800
+#endif
 
-static const char *prefix_http = "http://";
 static const char *prefix_https = "https://";
 static const char *upload_pack_service = "upload-pack";
 static const char *upload_pack_ls_service_url = "/info/refs?service=git-upload-pack";
@@ -48,10 +63,25 @@ static const int no_check_cert_flags = SECURITY_FLAG_IGNORE_CERT_CN_INVALID |
 	SECURITY_FLAG_IGNORE_CERT_DATE_INVALID |
 	SECURITY_FLAG_IGNORE_UNKNOWN_CA;
 
+#if defined(__MINGW32__)
+static const CLSID CLSID_InternetSecurityManager_mingw =
+	{ 0x7B8A2D94, 0x0AC9, 0x11D1,
+	{ 0x89, 0x6C, 0x00, 0xC0, 0x4F, 0xB6, 0xBF, 0xC4 } };
+static const IID IID_IInternetSecurityManager_mingw =
+	{ 0x79EAC9EE, 0xBAF9, 0x11CE,
+	{ 0x8C, 0x82, 0x00, 0xAA, 0x00, 0x4B, 0xA9, 0x0B } };
+
+# define CLSID_InternetSecurityManager CLSID_InternetSecurityManager_mingw
+# define IID_IInternetSecurityManager IID_IInternetSecurityManager_mingw
+#endif
+
 #define OWNING_SUBTRANSPORT(s) ((winhttp_subtransport *)(s)->parent.subtransport)
 
 typedef enum {
 	GIT_WINHTTP_AUTH_BASIC = 1,
+	GIT_WINHTTP_AUTH_NTLM = 2,
+	GIT_WINHTTP_AUTH_NEGOTIATE = 4,
+	GIT_WINHTTP_AUTH_DIGEST = 8,
 } winhttp_authmechanism_t;
 
 typedef struct {
@@ -73,109 +103,259 @@ typedef struct {
 typedef struct {
 	git_smart_subtransport parent;
 	transport_smart *owner;
-	const char *path;
-	char *host;
-	char *port;
-	char *user_from_url;
-	char *pass_from_url;
+	gitno_connection_data connection_data;
+	gitno_connection_data proxy_connection_data;
 	git_cred *cred;
 	git_cred *url_cred;
-	int auth_mechanism;
+	git_cred *proxy_cred;
+	int auth_mechanisms;
 	HINTERNET session;
 	HINTERNET connection;
-	unsigned use_ssl : 1;
 } winhttp_subtransport;
 
-static int apply_basic_credential(HINTERNET request, git_cred *cred)
+static int _apply_userpass_credential(HINTERNET request, DWORD target, DWORD scheme, git_cred *cred)
 {
 	git_cred_userpass_plaintext *c = (git_cred_userpass_plaintext *)cred;
-	git_buf buf = GIT_BUF_INIT, raw = GIT_BUF_INIT;
-	wchar_t *wide = NULL;
-	int error = -1, wide_len = 0;
+	wchar_t *user, *pass;
+	int user_len = 0, pass_len = 0, error = 0;
 
-	git_buf_printf(&raw, "%s:%s", c->username, c->password);
+	if ((error = user_len = git__utf8_to_16_alloc(&user, c->username)) < 0)
+		goto done;
 
-	if (git_buf_oom(&raw) ||
-		git_buf_puts(&buf, "Authorization: Basic ") < 0 ||
-		git_buf_put_base64(&buf, git_buf_cstr(&raw), raw.size) < 0)
-		goto on_error;
+	if ((error = pass_len = git__utf8_to_16_alloc(&pass, c->password)) < 0)
+		goto done;
 
-	wide_len = MultiByteToWideChar(CP_UTF8,	MB_ERR_INVALID_CHARS,
-		git_buf_cstr(&buf),	-1, NULL, 0);
+	if (!WinHttpSetCredentials(request, target, scheme, user, pass, NULL)) {
+		git_error_set(GIT_ERROR_OS, "failed to set credentials");
+		error = -1;
+	}
 
-	if (!wide_len) {
-		giterr_set(GITERR_OS, "Failed to measure string for wide conversion");
-		goto on_error;
+done:
+	if (user_len > 0)
+		git__memzero(user, user_len * sizeof(wchar_t));
+
+	if (pass_len > 0)
+		git__memzero(pass, pass_len * sizeof(wchar_t));
+
+	git__free(user);
+	git__free(pass);
+
+	return error;
+}
+
+static int apply_userpass_credential_proxy(HINTERNET request, git_cred *cred, int mechanisms)
+{
+	if (GIT_WINHTTP_AUTH_DIGEST & mechanisms) {
+		return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_PROXY,
+			WINHTTP_AUTH_SCHEME_DIGEST, cred);
 	}
 
-	wide = git__malloc(wide_len * sizeof(wchar_t));
+	return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_PROXY,
+		WINHTTP_AUTH_SCHEME_BASIC, cred);
+}
 
-	if (!wide)
-		goto on_error;
+static int apply_userpass_credential(HINTERNET request, int mechanisms, git_cred *cred)
+{
+	DWORD native_scheme;
+
+	if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) ||
+		(mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE)) {
+		native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
+	} else if (mechanisms & GIT_WINHTTP_AUTH_BASIC) {
+		native_scheme = WINHTTP_AUTH_SCHEME_BASIC;
+	} else {
+		git_error_set(GIT_ERROR_NET, "invalid authentication scheme");
+		return -1;
+	}
 
-	if (!MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
-		git_buf_cstr(&buf), -1, wide, wide_len)) {
-		giterr_set(GITERR_OS, "Failed to convert string to wide form");
-		goto on_error;
+	return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_SERVER,
+		native_scheme, cred);
+}
+
+static int apply_default_credentials(HINTERNET request, int mechanisms)
+{
+	/* Either the caller explicitly requested that default credentials be passed,
+	 * or our fallback credential callback was invoked and checked that the target
+	 * URI was in the appropriate Internet Explorer security zone. By setting this
+	 * flag, we guarantee that the credentials are delivered by WinHTTP. The default
+	 * is "medium" which applies to the intranet and sounds like it would correspond
+	 * to Internet Explorer security zones, but in fact does not. */
+	DWORD data = WINHTTP_AUTOLOGON_SECURITY_LEVEL_LOW;
+	DWORD native_scheme = 0;
+
+	if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) != 0)
+		native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
+
+	if ((mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) != 0)
+		native_scheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
+
+	if (!native_scheme) {
+		git_error_set(GIT_ERROR_NET, "invalid authentication scheme");
+		return -1;
 	}
 
-	if (!WinHttpAddRequestHeaders(request, wide, (ULONG) -1L, WINHTTP_ADDREQ_FLAG_ADD)) {
-		giterr_set(GITERR_OS, "Failed to add a header to the request");
-		goto on_error;
+	if (!WinHttpSetOption(request, WINHTTP_OPTION_AUTOLOGON_POLICY, &data, sizeof(DWORD)))
+		return -1;
+
+	if (!WinHttpSetCredentials(request, WINHTTP_AUTH_TARGET_SERVER, native_scheme, NULL, NULL, NULL))
+		return -1;
+
+	return 0;
+}
+
+static int fallback_cred_acquire_cb(
+	git_cred **cred,
+	const char *url,
+	const char *username_from_url,
+	unsigned int allowed_types,
+	void *payload)
+{
+	int error = 1;
+
+	GIT_UNUSED(username_from_url);
+	GIT_UNUSED(payload);
+
+	/* If the target URI supports integrated Windows authentication
+	 * as an authentication mechanism */
+	if (GIT_CREDTYPE_DEFAULT & allowed_types) {
+		wchar_t *wide_url;
+		HRESULT hCoInitResult;
+
+		/* Convert URL to wide characters */
+		if (git__utf8_to_16_alloc(&wide_url, url) < 0) {
+			git_error_set(GIT_ERROR_OS, "failed to convert string to wide form");
+			return -1;
+		}
+
+		hCoInitResult = CoInitializeEx(NULL, COINIT_MULTITHREADED);
+
+		if (SUCCEEDED(hCoInitResult) || hCoInitResult == RPC_E_CHANGED_MODE) {
+			IInternetSecurityManager* pISM;
+
+			/* And if the target URI is in the My Computer, Intranet, or Trusted zones */
+			if (SUCCEEDED(CoCreateInstance(&CLSID_InternetSecurityManager, NULL,
+				CLSCTX_ALL, &IID_IInternetSecurityManager, (void **)&pISM))) {
+				DWORD dwZone;
+
+				if (SUCCEEDED(pISM->lpVtbl->MapUrlToZone(pISM, wide_url, &dwZone, 0)) &&
+					(URLZONE_LOCAL_MACHINE == dwZone ||
+					URLZONE_INTRANET == dwZone ||
+					URLZONE_TRUSTED == dwZone)) {
+					git_cred *existing = *cred;
+
+					if (existing)
+						existing->free(existing);
+
+					/* Then use default Windows credentials to authenticate this request */
+					error = git_cred_default_new(cred);
+				}
+
+				pISM->lpVtbl->Release(pISM);
+			}
+
+            if (SUCCEEDED(hCoInitResult))
+                /* Only unitialize if the call to CoInitializeEx was successful. */
+                CoUninitialize();
+		}
+
+		git__free(wide_url);
 	}
 
-	error = 0;
+	return error;
+}
 
-on_error:
-	/* We were dealing with plaintext passwords, so clean up after ourselves a bit. */
-	if (wide)
-		memset(wide, 0x0, wide_len * sizeof(wchar_t));
+static int certificate_check(winhttp_stream *s, int valid)
+{
+	int error;
+	winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
+	PCERT_CONTEXT cert_ctx;
+	DWORD cert_ctx_size = sizeof(cert_ctx);
+	git_cert_x509 cert;
 
-	if (buf.size)
-		memset(buf.ptr, 0x0, buf.size);
+	/* If there is no override, we should fail if WinHTTP doesn't think it's fine */
+	if (t->owner->certificate_check_cb == NULL && !valid) {
+		if (!git_error_last())
+			git_error_set(GIT_ERROR_NET, "unknown certificate check failure");
 
-	if (raw.size)
-		memset(raw.ptr, 0x0, raw.size);
+		return GIT_ECERTIFICATE;
+	}
+
+	if (t->owner->certificate_check_cb == NULL || !t->connection_data.use_ssl)
+		return 0;
+
+	if (!WinHttpQueryOption(s->request, WINHTTP_OPTION_SERVER_CERT_CONTEXT, &cert_ctx, &cert_ctx_size)) {
+		git_error_set(GIT_ERROR_OS, "failed to get server certificate");
+		return -1;
+	}
+
+	git_error_clear();
+	cert.parent.cert_type = GIT_CERT_X509;
+	cert.data = cert_ctx->pbCertEncoded;
+	cert.len = cert_ctx->cbCertEncoded;
+	error = t->owner->certificate_check_cb((git_cert *) &cert, valid, t->connection_data.host, t->owner->message_cb_payload);
+	CertFreeCertificateContext(cert_ctx);
+
+	if (error == GIT_PASSTHROUGH)
+		error = valid ? 0 : GIT_ECERTIFICATE;
+
+	if (error < 0 && !git_error_last())
+		git_error_set(GIT_ERROR_NET, "user cancelled certificate check");
 
-	git__free(wide);
-	git_buf_free(&buf);
-	git_buf_free(&raw);
 	return error;
 }
 
+static void winhttp_stream_close(winhttp_stream *s)
+{
+	if (s->chunk_buffer) {
+		git__free(s->chunk_buffer);
+		s->chunk_buffer = NULL;
+	}
+
+	if (s->post_body) {
+		CloseHandle(s->post_body);
+		s->post_body = NULL;
+	}
+
+	if (s->request_uri) {
+		git__free(s->request_uri);
+		s->request_uri = NULL;
+	}
+
+	if (s->request) {
+		WinHttpCloseHandle(s->request);
+		s->request = NULL;
+	}
+
+	s->sent_request = 0;
+}
+
+#define SCHEME_HTTP  "http://"
+#define SCHEME_HTTPS "https://"
+
 static int winhttp_stream_connect(winhttp_stream *s)
 {
 	winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
 	git_buf buf = GIT_BUF_INIT;
 	char *proxy_url = NULL;
 	wchar_t ct[MAX_CONTENT_TYPE_LEN];
-	wchar_t *types[] = { L"*/*", NULL };
+	LPCWSTR types[] = { L"*/*", NULL };
 	BOOL peerdist = FALSE;
-	int error = -1, wide_len;
+	int error = -1;
+	unsigned long disable_redirects = WINHTTP_DISABLE_REDIRECTS;
+	int default_timeout = TIMEOUT_INFINITE;
+	int default_connect_timeout = DEFAULT_CONNECT_TIMEOUT;
+	size_t i;
+	const git_proxy_options *proxy_opts;
 
 	/* Prepare URL */
-	git_buf_printf(&buf, "%s%s", t->path, s->service_url);
+	git_buf_printf(&buf, "%s%s", t->connection_data.path, s->service_url);
 
 	if (git_buf_oom(&buf))
 		return -1;
 
 	/* Convert URL to wide characters */
-	wide_len = MultiByteToWideChar(CP_UTF8,	MB_ERR_INVALID_CHARS,
-		git_buf_cstr(&buf),	-1, NULL, 0);
-
-	if (!wide_len) {
-		giterr_set(GITERR_OS, "Failed to measure string for wide conversion");
-		goto on_error;
-	}
-
-	s->request_uri = git__malloc(wide_len * sizeof(wchar_t));
-
-	if (!s->request_uri)
-		goto on_error;
-
-	if (!MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
-		git_buf_cstr(&buf), -1, s->request_uri, wide_len)) {
-		giterr_set(GITERR_OS, "Failed to convert string to wide form");
+	if (git__utf8_to_16_alloc(&s->request_uri, git_buf_cstr(&buf)) < 0) {
+		git_error_set(GIT_ERROR_OS, "failed to convert string to wide form");
 		goto on_error;
 	}
 
@@ -187,46 +367,77 @@ static int winhttp_stream_connect(winhttp_stream *s)
 			NULL,
 			WINHTTP_NO_REFERER,
 			types,
-			t->use_ssl ? WINHTTP_FLAG_SECURE : 0);
+			t->connection_data.use_ssl ? WINHTTP_FLAG_SECURE : 0);
 
 	if (!s->request) {
-		giterr_set(GITERR_OS, "Failed to open request");
+		git_error_set(GIT_ERROR_OS, "failed to open request");
 		goto on_error;
 	}
 
-	/* Set proxy if necessary */
-	if (git_remote__get_http_proxy(t->owner->owner, t->use_ssl, &proxy_url) < 0)
+	if (!WinHttpSetTimeouts(s->request, default_timeout, default_connect_timeout, default_timeout, default_timeout)) {
+		git_error_set(GIT_ERROR_OS, "failed to set timeouts for WinHTTP");
 		goto on_error;
+	}
+
+	proxy_opts = &t->owner->proxy;
+	if (proxy_opts->type == GIT_PROXY_AUTO) {
+		/* Set proxy if necessary */
+		if (git_remote__get_http_proxy(t->owner->owner, !!t->connection_data.use_ssl, &proxy_url) < 0)
+			goto on_error;
+	}
+	else if (proxy_opts->type == GIT_PROXY_SPECIFIED) {
+		proxy_url = git__strdup(proxy_opts->url);
+		GIT_ERROR_CHECK_ALLOC(proxy_url);
+	}
 
 	if (proxy_url) {
+		git_buf processed_url = GIT_BUF_INIT;
 		WINHTTP_PROXY_INFO proxy_info;
 		wchar_t *proxy_wide;
 
-		/* Convert URL to wide characters */
-		wide_len = MultiByteToWideChar(CP_UTF8,	MB_ERR_INVALID_CHARS,
-			proxy_url, -1, NULL, 0);
+		if (!git__prefixcmp(proxy_url, SCHEME_HTTP)) {
+			t->proxy_connection_data.use_ssl = false;
+		} else if (!git__prefixcmp(proxy_url, SCHEME_HTTPS)) {
+			t->proxy_connection_data.use_ssl = true;
+		} else {
+			git_error_set(GIT_ERROR_NET, "invalid URL: '%s'", proxy_url);
+			return -1;
+		}
+
+		gitno_connection_data_free_ptrs(&t->proxy_connection_data);
 
-		if (!wide_len) {
-			giterr_set(GITERR_OS, "Failed to measure string for wide conversion");
+		if ((error = gitno_extract_url_parts(&t->proxy_connection_data.host, &t->proxy_connection_data.port, NULL,
+				&t->proxy_connection_data.user, &t->proxy_connection_data.pass, proxy_url, NULL)) < 0)
 			goto on_error;
+
+		if (t->proxy_connection_data.user && t->proxy_connection_data.pass) {
+			if (t->proxy_cred) {
+				t->proxy_cred->free(t->proxy_cred);
+			}
+
+			if ((error = git_cred_userpass_plaintext_new(&t->proxy_cred, t->proxy_connection_data.user, t->proxy_connection_data.pass)) < 0)
+				goto on_error;
 		}
 
-		proxy_wide = git__malloc(wide_len * sizeof(wchar_t));
+		if (t->proxy_connection_data.use_ssl)
+			git_buf_PUTS(&processed_url, SCHEME_HTTPS);
+		else
+			git_buf_PUTS(&processed_url, SCHEME_HTTP);
 
-		if (!proxy_wide)
-			goto on_error;
+		git_buf_puts(&processed_url, t->proxy_connection_data.host);
+		if (t->proxy_connection_data.port)
+			git_buf_printf(&processed_url, ":%s", t->proxy_connection_data.port);
 
-		if (!MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
-			proxy_url, -1, proxy_wide, wide_len)) {
-			giterr_set(GITERR_OS, "Failed to convert string to wide form");
-			git__free(proxy_wide);
+		if (git_buf_oom(&processed_url)) {
+			error = -1;
 			goto on_error;
 		}
 
-		/* Strip any trailing forward slash on the proxy URL;
-		 * WinHTTP doesn't like it if one is present */
-		if (wide_len > 1 && L'/' == proxy_wide[wide_len - 2])
-			proxy_wide[wide_len - 2] = L'\0';
+		/* Convert URL to wide characters */
+		error = git__utf8_to_16_alloc(&proxy_wide, processed_url.ptr);
+		git_buf_dispose(&processed_url);
+		if (error < 0)
+			goto on_error;
 
 		proxy_info.dwAccessType = WINHTTP_ACCESS_TYPE_NAMED_PROXY;
 		proxy_info.lpszProxy = proxy_wide;
@@ -236,12 +447,31 @@ static int winhttp_stream_connect(winhttp_stream *s)
 			WINHTTP_OPTION_PROXY,
 			&proxy_info,
 			sizeof(WINHTTP_PROXY_INFO))) {
-			giterr_set(GITERR_OS, "Failed to set proxy");
+			git_error_set(GIT_ERROR_OS, "failed to set proxy");
 			git__free(proxy_wide);
 			goto on_error;
 		}
 
 		git__free(proxy_wide);
+
+		if (t->proxy_cred) {
+			if (t->proxy_cred->credtype == GIT_CREDTYPE_USERPASS_PLAINTEXT) {
+				if ((error = apply_userpass_credential_proxy(s->request, t->proxy_cred, t->auth_mechanisms)) < 0)
+					goto on_error;
+			}
+		}
+
+	}
+
+	/* Disable WinHTTP redirects so we can handle them manually. Why, you ask?
+	 * http://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/b2ff8879-ab9f-4218-8f09-16d25dff87ae
+	 */
+	if (!WinHttpSetOption(s->request,
+		WINHTTP_OPTION_DISABLE_FEATURE,
+		&disable_redirects,
+		sizeof(disable_redirects))) {
+			git_error_set(GIT_ERROR_OS, "failed to disable redirects");
+			goto on_error;
 	}
 
 	/* Strip unwanted headers (X-P2P-PeerDist, X-P2P-PeerDistEx) that WinHTTP
@@ -254,53 +484,89 @@ static int winhttp_stream_connect(winhttp_stream *s)
 
 	/* Send Pragma: no-cache header */
 	if (!WinHttpAddRequestHeaders(s->request, pragma_nocache, (ULONG) -1L, WINHTTP_ADDREQ_FLAG_ADD)) {
-		giterr_set(GITERR_OS, "Failed to add a header to the request");
+		git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
 		goto on_error;
 	}
 
-	/* Send Content-Type header -- only necessary on a POST */
 	if (post_verb == s->verb) {
+		/* Send Content-Type and Accept headers -- only necessary on a POST */
 		git_buf_clear(&buf);
-		if (git_buf_printf(&buf, "Content-Type: application/x-git-%s-request", s->service) < 0)
+		if (git_buf_printf(&buf,
+			"Content-Type: application/x-git-%s-request",
+			s->service) < 0)
 			goto on_error;
 
-		git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_buf_cstr(&buf));
+		if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_buf_cstr(&buf)) < 0) {
+			git_error_set(GIT_ERROR_OS, "failed to convert content-type to wide characters");
+			goto on_error;
+		}
+
+		if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
+			WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
+			git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
+			goto on_error;
+		}
+
+		git_buf_clear(&buf);
+		if (git_buf_printf(&buf,
+			"Accept: application/x-git-%s-result",
+			s->service) < 0)
+			goto on_error;
+
+		if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_buf_cstr(&buf)) < 0) {
+			git_error_set(GIT_ERROR_OS, "failed to convert accept header to wide characters");
+			goto on_error;
+		}
 
-		if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG) -1L, WINHTTP_ADDREQ_FLAG_ADD)) {
-			giterr_set(GITERR_OS, "Failed to add a header to the request");
+		if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
+			WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
+			git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
 			goto on_error;
 		}
 	}
 
+	for (i = 0; i < t->owner->custom_headers.count; i++) {
+		if (t->owner->custom_headers.strings[i]) {
+			git_buf_clear(&buf);
+			git_buf_puts(&buf, t->owner->custom_headers.strings[i]);
+			if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_buf_cstr(&buf)) < 0) {
+				git_error_set(GIT_ERROR_OS, "failed to convert custom header to wide characters");
+				goto on_error;
+			}
+
+			if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
+				WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
+				git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
+				goto on_error;
+			}
+		}
+	}
+
 	/* If requested, disable certificate validation */
-	if (t->use_ssl) {
+	if (t->connection_data.use_ssl) {
 		int flags;
 
 		if (t->owner->parent.read_flags(&t->owner->parent, &flags) < 0)
 			goto on_error;
-
-		if ((GIT_TRANSPORTFLAGS_NO_CHECK_CERT & flags) &&
-			!WinHttpSetOption(s->request, WINHTTP_OPTION_SECURITY_FLAGS,
-			(LPVOID)&no_check_cert_flags, sizeof(no_check_cert_flags))) {
-			giterr_set(GITERR_OS, "Failed to set options to ignore cert errors");
-			goto on_error;
-		}
 	}
 
 	/* If we have a credential on the subtransport, apply it to the request */
 	if (t->cred &&
 		t->cred->credtype == GIT_CREDTYPE_USERPASS_PLAINTEXT &&
-		t->auth_mechanism == GIT_WINHTTP_AUTH_BASIC &&
-		apply_basic_credential(s->request, t->cred) < 0)
+		apply_userpass_credential(s->request, t->auth_mechanisms, t->cred) < 0)
+		goto on_error;
+	else if (t->cred &&
+		t->cred->credtype == GIT_CREDTYPE_DEFAULT &&
+		apply_default_credentials(s->request, t->auth_mechanisms) < 0)
 		goto on_error;
 
 	/* If no other credentials have been applied and the URL has username and
 	 * password, use those */
-	if (!t->cred && t->user_from_url && t->pass_from_url) {
+	if (!t->cred && t->connection_data.user && t->connection_data.pass) {
 		if (!t->url_cred &&
-			 git_cred_userpass_plaintext_new(&t->url_cred, t->user_from_url, t->pass_from_url) < 0)
+			git_cred_userpass_plaintext_new(&t->url_cred, t->connection_data.user, t->connection_data.pass) < 0)
 			goto on_error;
-		if (apply_basic_credential(s->request, t->url_cred) < 0)
+		if (apply_userpass_credential(s->request, GIT_WINHTTP_AUTH_BASIC, t->url_cred) < 0)
 			goto on_error;
 	}
 
@@ -309,32 +575,51 @@ static int winhttp_stream_connect(winhttp_stream *s)
 	error = 0;
 
 on_error:
+	if (error < 0)
+		winhttp_stream_close(s);
+
 	git__free(proxy_url);
-	git_buf_free(&buf);
+	git_buf_dispose(&buf);
 	return error;
 }
 
 static int parse_unauthorized_response(
 	HINTERNET request,
 	int *allowed_types,
-	int *auth_mechanism)
+	int *allowed_mechanisms)
 {
 	DWORD supported, first, target;
 
 	*allowed_types = 0;
-	*auth_mechanism = 0;
+	*allowed_mechanisms = 0;
 
-	/* WinHttpQueryHeaders() must be called before WinHttpQueryAuthSchemes(). 
-	 * We can assume this was already done, since we know we are unauthorized. 
+	/* WinHttpQueryHeaders() must be called before WinHttpQueryAuthSchemes().
+	 * We can assume this was already done, since we know we are unauthorized.
 	 */
 	if (!WinHttpQueryAuthSchemes(request, &supported, &first, &target)) {
-		giterr_set(GITERR_OS, "Failed to parse supported auth schemes"); 
+		git_error_set(GIT_ERROR_OS, "failed to parse supported auth schemes");
 		return -1;
 	}
 
+	if (WINHTTP_AUTH_SCHEME_NTLM & supported) {
+		*allowed_types |= GIT_CREDTYPE_USERPASS_PLAINTEXT;
+		*allowed_types |= GIT_CREDTYPE_DEFAULT;
+		*allowed_mechanisms |= GIT_WINHTTP_AUTH_NTLM;
+	}
+
+	if (WINHTTP_AUTH_SCHEME_NEGOTIATE & supported) {
+		*allowed_types |= GIT_CREDTYPE_DEFAULT;
+		*allowed_mechanisms |= GIT_WINHTTP_AUTH_NEGOTIATE;
+	}
+
 	if (WINHTTP_AUTH_SCHEME_BASIC & supported) {
 		*allowed_types |= GIT_CREDTYPE_USERPASS_PLAINTEXT;
-		*auth_mechanism = GIT_WINHTTP_AUTH_BASIC;
+		*allowed_mechanisms |= GIT_WINHTTP_AUTH_BASIC;
+	}
+
+	if (WINHTTP_AUTH_SCHEME_DIGEST & supported) {
+		*allowed_types |= GIT_CREDTYPE_USERPASS_PLAINTEXT;
+		*allowed_mechanisms |= GIT_WINHTTP_AUTH_DIGEST;
 	}
 
 	return 0;
@@ -346,7 +631,7 @@ static int write_chunk(HINTERNET request, const char *buffer, size_t len)
 	git_buf buf = GIT_BUF_INIT;
 
 	/* Chunk header */
-	git_buf_printf(&buf, "%X\r\n", len);
+	git_buf_printf(&buf, "%"PRIXZ"\r\n", len);
 
 	if (git_buf_oom(&buf))
 		return -1;
@@ -354,18 +639,18 @@ static int write_chunk(HINTERNET request, const char *buffer, size_t len)
 	if (!WinHttpWriteData(request,
 		git_buf_cstr(&buf),	(DWORD)git_buf_len(&buf),
 		&bytes_written)) {
-		git_buf_free(&buf);
-		giterr_set(GITERR_OS, "Failed to write chunk header");
+		git_buf_dispose(&buf);
+		git_error_set(GIT_ERROR_OS, "failed to write chunk header");
 		return -1;
 	}
 
-	git_buf_free(&buf);
+	git_buf_dispose(&buf);
 
 	/* Chunk body */
 	if (!WinHttpWriteData(request,
 		buffer, (DWORD)len,
 		&bytes_written)) {
-		giterr_set(GITERR_OS, "Failed to write chunk");
+		git_error_set(GIT_ERROR_OS, "failed to write chunk");
 		return -1;
 	}
 
@@ -373,13 +658,238 @@ static int write_chunk(HINTERNET request, const char *buffer, size_t len)
 	if (!WinHttpWriteData(request,
 		"\r\n", 2,
 		&bytes_written)) {
-		giterr_set(GITERR_OS, "Failed to write chunk footer");
+		git_error_set(GIT_ERROR_OS, "failed to write chunk footer");
 		return -1;
 	}
 
 	return 0;
 }
 
+static int winhttp_close_connection(winhttp_subtransport *t)
+{
+	int ret = 0;
+
+	if (t->connection) {
+		if (!WinHttpCloseHandle(t->connection)) {
+			git_error_set(GIT_ERROR_OS, "unable to close connection");
+			ret = -1;
+		}
+
+		t->connection = NULL;
+	}
+
+	if (t->session) {
+		if (!WinHttpCloseHandle(t->session)) {
+			git_error_set(GIT_ERROR_OS, "unable to close session");
+			ret = -1;
+		}
+
+		t->session = NULL;
+	}
+
+	return ret;
+}
+
+static void CALLBACK winhttp_status(
+	HINTERNET connection,
+	DWORD_PTR ctx,
+	DWORD code,
+	LPVOID info,
+	DWORD info_len)
+{
+	DWORD status;
+
+	if (code != WINHTTP_CALLBACK_STATUS_SECURE_FAILURE)
+		return;
+
+	status = *((DWORD *)info);
+
+	if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_CN_INVALID))
+		git_error_set(GIT_ERROR_NET, "SSL certificate issued for different common name");
+	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_DATE_INVALID))
+		git_error_set(GIT_ERROR_NET, "SSL certificate has expired");
+	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA))
+		git_error_set(GIT_ERROR_NET, "SSL certificate signed by unknown CA");
+	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CERT))
+		git_error_set(GIT_ERROR_NET, "SSL certificate is invalid");
+	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED))
+		git_error_set(GIT_ERROR_NET, "certificate revocation check failed");
+	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_REVOKED))
+		git_error_set(GIT_ERROR_NET, "SSL certificate was revoked");
+	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR))
+		git_error_set(GIT_ERROR_NET, "security libraries could not be loaded");
+	else
+		git_error_set(GIT_ERROR_NET, "unknown security error %lu", status);
+}
+
+static int winhttp_connect(
+	winhttp_subtransport *t)
+{
+	wchar_t *wide_host;
+	int32_t port;
+	wchar_t *wide_ua;
+	git_buf ua = GIT_BUF_INIT;
+	int error = -1;
+	int default_timeout = TIMEOUT_INFINITE;
+	int default_connect_timeout = DEFAULT_CONNECT_TIMEOUT;
+	DWORD protocols =
+		WINHTTP_FLAG_SECURE_PROTOCOL_TLS1 |
+		WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 |
+		WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2;
+
+	t->session = NULL;
+	t->connection = NULL;
+
+	/* Prepare port */
+	if (git__strntol32(&port, t->connection_data.port,
+			   strlen(t->connection_data.port), NULL, 10) < 0)
+		return -1;
+
+	/* Prepare host */
+	if (git__utf8_to_16_alloc(&wide_host, t->connection_data.host) < 0) {
+		git_error_set(GIT_ERROR_OS, "unable to convert host to wide characters");
+		return -1;
+	}
+
+
+	if ((error = git_http__user_agent(&ua)) < 0) {
+		git__free(wide_host);
+		return error;
+	}
+
+	if (git__utf8_to_16_alloc(&wide_ua, git_buf_cstr(&ua)) < 0) {
+		git_error_set(GIT_ERROR_OS, "unable to convert host to wide characters");
+		git__free(wide_host);
+		git_buf_dispose(&ua);
+		return -1;
+	}
+
+	git_buf_dispose(&ua);
+
+	/* Establish session */
+	t->session = WinHttpOpen(
+		wide_ua,
+		WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
+		WINHTTP_NO_PROXY_NAME,
+		WINHTTP_NO_PROXY_BYPASS,
+		0);
+
+	if (!t->session) {
+		git_error_set(GIT_ERROR_OS, "failed to init WinHTTP");
+		goto on_error;
+	}
+
+	/*
+	 * Do a best-effort attempt to enable TLS 1.2 but allow this to
+	 * fail; if TLS 1.2 support is not available for some reason,
+	 * ignore the failure (it will keep the default protocols).
+	 */
+	WinHttpSetOption(t->session,
+		WINHTTP_OPTION_SECURE_PROTOCOLS,
+		&protocols,
+		sizeof(protocols));
+
+	if (!WinHttpSetTimeouts(t->session, default_timeout, default_connect_timeout, default_timeout, default_timeout)) {
+		git_error_set(GIT_ERROR_OS, "failed to set timeouts for WinHTTP");
+		goto on_error;
+	}
+
+
+	/* Establish connection */
+	t->connection = WinHttpConnect(
+		t->session,
+		wide_host,
+		(INTERNET_PORT) port,
+		0);
+
+	if (!t->connection) {
+		git_error_set(GIT_ERROR_OS, "failed to connect to host");
+		goto on_error;
+	}
+
+	if (WinHttpSetStatusCallback(t->connection, winhttp_status, WINHTTP_CALLBACK_FLAG_SECURE_FAILURE, 0) == WINHTTP_INVALID_STATUS_CALLBACK) {
+		git_error_set(GIT_ERROR_OS, "failed to set status callback");
+		goto on_error;
+	}
+
+	error = 0;
+
+on_error:
+	if (error < 0)
+		winhttp_close_connection(t);
+
+	git__free(wide_host);
+	git__free(wide_ua);
+
+	return error;
+}
+
+static int do_send_request(winhttp_stream *s, size_t len, int ignore_length)
+{
+	int attempts;
+	bool success;
+
+	for (attempts = 0; attempts < 5; attempts++) {
+		if (ignore_length) {
+			success = WinHttpSendRequest(s->request,
+				WINHTTP_NO_ADDITIONAL_HEADERS, 0,
+				WINHTTP_NO_REQUEST_DATA, 0,
+				WINHTTP_IGNORE_REQUEST_TOTAL_LENGTH, 0);
+		} else {
+			success = WinHttpSendRequest(s->request,
+				WINHTTP_NO_ADDITIONAL_HEADERS, 0,
+				WINHTTP_NO_REQUEST_DATA, 0,
+				len, 0);
+		}
+
+		if (success || GetLastError() != (DWORD)SEC_E_BUFFER_TOO_SMALL)
+			break;
+	}
+
+	return success ? 0 : -1;
+}
+
+static int send_request(winhttp_stream *s, size_t len, int ignore_length)
+{
+	int request_failed = 0, cert_valid = 1, error = 0;
+	DWORD ignore_flags;
+
+	git_error_clear();
+	if ((error = do_send_request(s, len, ignore_length)) < 0) {
+		if (GetLastError() != ERROR_WINHTTP_SECURE_FAILURE) {
+			git_error_set(GIT_ERROR_OS, "failed to send request");
+			return -1;
+		}
+
+		request_failed = 1;
+		cert_valid = 0;
+	}
+
+	git_error_clear();
+	if ((error = certificate_check(s, cert_valid)) < 0) {
+		if (!git_error_last())
+			git_error_set(GIT_ERROR_OS, "user cancelled certificate check");
+
+		return error;
+	}
+
+	/* if neither the request nor the certificate check returned errors, we're done */
+	if (!request_failed)
+		return 0;
+
+	ignore_flags = no_check_cert_flags;
+
+	if (!WinHttpSetOption(s->request, WINHTTP_OPTION_SECURITY_FLAGS, &ignore_flags, sizeof(ignore_flags))) {
+		git_error_set(GIT_ERROR_OS, "failed to set security options");
+		return -1;
+	}
+
+	if ((error = do_send_request(s, len, ignore_length)) < 0)
+		git_error_set(GIT_ERROR_OS, "failed to send request with unchecked certificate");
+
+	return error;
+}
+
 static int winhttp_stream_read(
 	git_smart_subtransport_stream *stream,
 	char *buffer,
@@ -390,11 +900,12 @@ static int winhttp_stream_read(
 	winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
 	DWORD dw_bytes_read;
 	char replay_count = 0;
+	int error;
 
 replay:
 	/* Enforce a reasonable cap on the number of replays */
-	if (++replay_count >= 7) {
-		giterr_set(GITERR_NET, "Too many redirects or authentication replays");
+	if (replay_count++ >= GIT_HTTP_REPLAY_MAX) {
+		git_error_set(GIT_ERROR_NET, "too many redirects or authentication replays");
 		return -1;
 	}
 
@@ -408,13 +919,9 @@ replay:
 		wchar_t expected_content_type[MAX_CONTENT_TYPE_LEN], content_type[MAX_CONTENT_TYPE_LEN];
 
 		if (!s->sent_request) {
-			if (!WinHttpSendRequest(s->request,
-				WINHTTP_NO_ADDITIONAL_HEADERS, 0,
-				WINHTTP_NO_REQUEST_DATA, 0,
-				s->post_body_len, 0)) {
-				giterr_set(GITERR_OS, "Failed to send request");
-				return -1;
-			}
+
+			if ((error = send_request(s, s->post_body_len, 0)) < 0)
+				return error;
 
 			s->sent_request = 1;
 		}
@@ -433,7 +940,7 @@ replay:
 			if (!WinHttpWriteData(s->request,
 				"0\r\n\r\n", 5,
 				&bytes_written)) {
-				giterr_set(GITERR_OS, "Failed to write final chunk");
+				git_error_set(GIT_ERROR_OS, "failed to write final chunk");
 				return -1;
 			}
 		}
@@ -444,7 +951,7 @@ replay:
 			if (INVALID_SET_FILE_POINTER == SetFilePointer(s->post_body,
 					0, 0, FILE_BEGIN) &&
 				NO_ERROR != GetLastError()) {
-				giterr_set(GITERR_OS, "Failed to reset file pointer");
+				git_error_set(GIT_ERROR_OS, "failed to reset file pointer");
 				return -1;
 			}
 
@@ -458,14 +965,14 @@ replay:
 					&bytes_read, NULL) ||
 					!bytes_read) {
 					git__free(buffer);
-					giterr_set(GITERR_OS, "Failed to read from temp file");
+					git_error_set(GIT_ERROR_OS, "failed to read from temp file");
 					return -1;
 				}
 
 				if (!WinHttpWriteData(s->request, buffer,
 					bytes_read, &bytes_written)) {
 					git__free(buffer);
-					giterr_set(GITERR_OS, "Failed to write data");
+					git_error_set(GIT_ERROR_OS, "failed to write data");
 					return -1;
 				}
 
@@ -481,7 +988,7 @@ replay:
 		}
 
 		if (!WinHttpReceiveResponse(s->request, 0)) {
-			giterr_set(GITERR_OS, "Failed to receive response");
+			git_error_set(GIT_ERROR_OS, "failed to receive response");
 			return -1;
 		}
 
@@ -493,7 +1000,7 @@ replay:
 			WINHTTP_HEADER_NAME_BY_INDEX,
 			&status_code, &status_code_length,
 			WINHTTP_NO_HEADER_INDEX)) {
-				giterr_set(GITERR_OS, "Failed to retrieve status code");
+				git_error_set(GIT_ERROR_OS, "failed to retrieve status code");
 				return -1;
 		}
 
@@ -511,89 +1018,145 @@ replay:
 
 			/* Check for Windows 7. This workaround is only necessary on
 			 * Windows Vista and earlier. Windows 7 is version 6.1. */
-			if (!git_has_win32_version(6, 1)) {
-				wchar_t *location;
-				DWORD location_length;
-				int redirect_cmp;
-
-				/* OK, fetch the Location header from the redirect. */
-				if (WinHttpQueryHeaders(s->request,
-					WINHTTP_QUERY_LOCATION,
-					WINHTTP_HEADER_NAME_BY_INDEX,
-					WINHTTP_NO_OUTPUT_BUFFER,
-					&location_length,
-					WINHTTP_NO_HEADER_INDEX) ||
-					GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
-					giterr_set(GITERR_OS, "Failed to read Location header");
+			wchar_t *location;
+			DWORD location_length;
+			char *location8;
+
+			/* OK, fetch the Location header from the redirect. */
+			if (WinHttpQueryHeaders(s->request,
+				WINHTTP_QUERY_LOCATION,
+				WINHTTP_HEADER_NAME_BY_INDEX,
+				WINHTTP_NO_OUTPUT_BUFFER,
+				&location_length,
+				WINHTTP_NO_HEADER_INDEX) ||
+				GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
+				git_error_set(GIT_ERROR_OS, "failed to read Location header");
+				return -1;
+			}
+
+			location = git__malloc(location_length);
+			GIT_ERROR_CHECK_ALLOC(location);
+
+			if (!WinHttpQueryHeaders(s->request,
+				WINHTTP_QUERY_LOCATION,
+				WINHTTP_HEADER_NAME_BY_INDEX,
+				location,
+				&location_length,
+				WINHTTP_NO_HEADER_INDEX)) {
+				git_error_set(GIT_ERROR_OS, "failed to read Location header");
+				git__free(location);
+				return -1;
+			}
+
+			/* Convert the Location header to UTF-8 */
+			if (git__utf16_to_8_alloc(&location8, location) < 0) {
+				git_error_set(GIT_ERROR_OS, "failed to convert Location header to UTF-8");
+				git__free(location);
+				return -1;
+			}
+
+			git__free(location);
+
+			/* Replay the request */
+			winhttp_stream_close(s);
+
+			if (!git__prefixcmp_icase(location8, prefix_https)) {
+				/* Upgrade to secure connection; disconnect and start over */
+				if (gitno_connection_data_from_url(&t->connection_data, location8, s->service_url) < 0) {
+					git__free(location8);
 					return -1;
 				}
 
-				location = git__malloc(location_length);
-				GITERR_CHECK_ALLOC(location);
-
-				if (!WinHttpQueryHeaders(s->request,
-					WINHTTP_QUERY_LOCATION,
-					WINHTTP_HEADER_NAME_BY_INDEX,
-					location,
-					&location_length,
-					WINHTTP_NO_HEADER_INDEX)) {
-					giterr_set(GITERR_OS, "Failed to read Location header");
-					git__free(location);
+				winhttp_close_connection(t);
+
+				if (winhttp_connect(t) < 0)
 					return -1;
-				}
+			}
 
-				/* Compare the Location header with the request URI */
-				redirect_cmp = wcscmp(location, s->request_uri);
-				git__free(location);
+			git__free(location8);
+			goto replay;
+		}
 
-				if (!redirect_cmp) {
-					/* Replay the request */
-					WinHttpCloseHandle(s->request);
-					s->request = NULL;
-					s->sent_request = 0;
+		/* Handle proxy authentication failures */
+		if (status_code == HTTP_STATUS_PROXY_AUTH_REQ) {
+			int allowed_types;
 
-					goto replay;
-				}
+			if (parse_unauthorized_response(s->request, &allowed_types, &t->auth_mechanisms) < 0)
+				return -1;
+
+			/* TODO: extract the username from the url, no payload? */
+			if (t->owner->proxy.credentials) {
+				int cred_error = 1;
+				cred_error = t->owner->proxy.credentials(&t->proxy_cred, t->owner->proxy.url, NULL, allowed_types, t->owner->proxy.payload);
+
+				if (cred_error < 0)
+					return cred_error;
 			}
+
+			winhttp_stream_close(s);
+			goto replay;
 		}
 
 		/* Handle authentication failures */
-		if (HTTP_STATUS_DENIED == status_code &&
-			get_verb == s->verb && t->owner->cred_acquire_cb) {
+		if (HTTP_STATUS_DENIED == status_code && get_verb == s->verb) {
 			int allowed_types;
 
-			if (parse_unauthorized_response(s->request, &allowed_types, &t->auth_mechanism) < 0)
+			if (parse_unauthorized_response(s->request, &allowed_types, &t->auth_mechanisms) < 0)
 				return -1;
 
-			if (allowed_types &&
-				(!t->cred || 0 == (t->cred->credtype & allowed_types))) {
+			if (allowed_types) {
+				int cred_error = 1;
+
+				git_cred_free(t->cred);
+				t->cred = NULL;
+				/* Start with the user-supplied credential callback, if present */
+				if (t->owner->cred_acquire_cb) {
+					cred_error = t->owner->cred_acquire_cb(&t->cred, t->owner->url,
+						t->connection_data.user, allowed_types,	t->owner->cred_acquire_payload);
+
+					/* Treat GIT_PASSTHROUGH as though git_cred_acquire_cb isn't set */
+					if (cred_error == GIT_PASSTHROUGH)
+						cred_error = 1;
+					else if (cred_error < 0)
+						return cred_error;
+				}
 
-				if (t->owner->cred_acquire_cb(&t->cred, t->owner->url, t->user_from_url, allowed_types, t->owner->cred_acquire_payload) < 0)
-					return -1;
+				/* Invoke the fallback credentials acquisition callback if necessary */
+				if (cred_error > 0) {
+					cred_error = fallback_cred_acquire_cb(&t->cred, t->owner->url,
+						t->connection_data.user, allowed_types, NULL);
+
+					if (cred_error < 0)
+						return cred_error;
+				}
 
-				assert(t->cred);
+				if (!cred_error) {
+					assert(t->cred);
 
-				WinHttpCloseHandle(s->request);
-				s->request = NULL;
-				s->sent_request = 0;
+					winhttp_stream_close(s);
 
-				/* Successfully acquired a credential */
-				goto replay;
+					/* Successfully acquired a credential */
+					goto replay;
+				}
 			}
 		}
 
 		if (HTTP_STATUS_OK != status_code) {
-			giterr_set(GITERR_NET, "Request failed with status code: %d", status_code);
+			git_error_set(GIT_ERROR_NET, "request failed with status code: %lu", status_code);
 			return -1;
 		}
 
 		/* Verify that we got the correct content-type back */
 		if (post_verb == s->verb)
-			snprintf(expected_content_type_8, MAX_CONTENT_TYPE_LEN, "application/x-git-%s-result", s->service);
+			p_snprintf(expected_content_type_8, MAX_CONTENT_TYPE_LEN, "application/x-git-%s-result", s->service);
 		else
-			snprintf(expected_content_type_8, MAX_CONTENT_TYPE_LEN, "application/x-git-%s-advertisement", s->service);
+			p_snprintf(expected_content_type_8, MAX_CONTENT_TYPE_LEN, "application/x-git-%s-advertisement", s->service);
+
+		if (git__utf8_to_16(expected_content_type, MAX_CONTENT_TYPE_LEN, expected_content_type_8) < 0) {
+			git_error_set(GIT_ERROR_OS, "failed to convert expected content-type to wide characters");
+			return -1;
+		}
 
-		git__utf8_to_16(expected_content_type, MAX_CONTENT_TYPE_LEN, expected_content_type_8);
 		content_type_length = sizeof(content_type);
 
 		if (!WinHttpQueryHeaders(s->request,
@@ -601,12 +1164,12 @@ replay:
 			WINHTTP_HEADER_NAME_BY_INDEX,
 			&content_type, &content_type_length,
 			WINHTTP_NO_HEADER_INDEX)) {
-				giterr_set(GITERR_OS, "Failed to retrieve response content-type");
+				git_error_set(GIT_ERROR_OS, "failed to retrieve response content-type");
 				return -1;
 		}
 
 		if (wcscmp(expected_content_type, content_type)) {
-			giterr_set(GITERR_NET, "Received unexpected content-type");
+			git_error_set(GIT_ERROR_NET, "received unexpected content-type");
 			return -1;
 		}
 
@@ -618,7 +1181,7 @@ replay:
 		(DWORD)buf_size,
 		&dw_bytes_read))
 	{
-		giterr_set(GITERR_OS, "Failed to read data");
+		git_error_set(GIT_ERROR_OS, "failed to read data");
 		return -1;
 	}
 
@@ -633,25 +1196,20 @@ static int winhttp_stream_write_single(
 	size_t len)
 {
 	winhttp_stream *s = (winhttp_stream *)stream;
-	winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
 	DWORD bytes_written;
+	int error;
 
 	if (!s->request && winhttp_stream_connect(s) < 0)
 		return -1;
 
 	/* This implementation of write permits only a single call. */
 	if (s->sent_request) {
-		giterr_set(GITERR_NET, "Subtransport configured for only one write");
+		git_error_set(GIT_ERROR_NET, "subtransport configured for only one write");
 		return -1;
 	}
 
-	if (!WinHttpSendRequest(s->request,
-			WINHTTP_NO_ADDITIONAL_HEADERS, 0,
-			WINHTTP_NO_REQUEST_DATA, 0,
-			(DWORD)len, 0)) {
-		giterr_set(GITERR_OS, "Failed to send request");
-		return -1;
-	}
+	if ((error = send_request(s, len, 0)) < 0)
+		return error;
 
 	s->sent_request = 1;
 
@@ -659,7 +1217,7 @@ static int winhttp_stream_write_single(
 			(LPCVOID)buffer,
 			(DWORD)len,
 			&bytes_written)) {
-		giterr_set(GITERR_OS, "Failed to write data");
+		git_error_set(GIT_ERROR_OS, "failed to write data");
 		return -1;
 	}
 
@@ -672,29 +1230,32 @@ static int put_uuid_string(LPWSTR buffer, size_t buffer_len_cch)
 {
 	UUID uuid;
 	RPC_STATUS status = UuidCreate(&uuid);
-	HRESULT result;
+	int result;
 
 	if (RPC_S_OK != status &&
 		RPC_S_UUID_LOCAL_ONLY != status &&
 		RPC_S_UUID_NO_ADDRESS != status) {
-		giterr_set(GITERR_NET, "Unable to generate name for temp file");
+		git_error_set(GIT_ERROR_NET, "unable to generate name for temp file");
 		return -1;
 	}
 
 	if (buffer_len_cch < UUID_LENGTH_CCH + 1) {
-		giterr_set(GITERR_NET, "Buffer too small for name of temp file");
+		git_error_set(GIT_ERROR_NET, "buffer too small for name of temp file");
 		return -1;
 	}
 
-	result = StringCbPrintfW(
-		buffer, buffer_len_cch,
+#if !defined(__MINGW32__) || defined(MINGW_HAS_SECURE_API)
+	result = swprintf_s(buffer, buffer_len_cch,
+#else
+	result = wsprintfW(buffer,
+#endif
 		L"%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x",
 		uuid.Data1, uuid.Data2, uuid.Data3,
 		uuid.Data4[0], uuid.Data4[1], uuid.Data4[2], uuid.Data4[3],
 		uuid.Data4[4], uuid.Data4[5], uuid.Data4[6], uuid.Data4[7]);
 
-	if (FAILED(result)) {
-		giterr_set(GITERR_OS, "Unable to generate name for temp file");
+	if (result < UUID_LENGTH_CCH) {
+		git_error_set(GIT_ERROR_OS, "unable to generate name for temp file");
 		return -1;
 	}
 
@@ -706,7 +1267,7 @@ static int get_temp_file(LPWSTR buffer, DWORD buffer_len_cch)
 	size_t len;
 
 	if (!GetTempPathW(buffer_len_cch, buffer)) {
-		giterr_set(GITERR_OS, "Failed to get temp path");
+		git_error_set(GIT_ERROR_OS, "failed to get temp path");
 		return -1;
 	}
 
@@ -727,7 +1288,6 @@ static int winhttp_stream_write_buffered(
 	size_t len)
 {
 	winhttp_stream *s = (winhttp_stream *)stream;
-	winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
 	DWORD bytes_written;
 
 	if (!s->request && winhttp_stream_connect(s) < 0)
@@ -750,13 +1310,13 @@ static int winhttp_stream_write_buffered(
 
 		if (INVALID_HANDLE_VALUE == s->post_body) {
 			s->post_body = NULL;
-			giterr_set(GITERR_OS, "Failed to create temporary file");
+			git_error_set(GIT_ERROR_OS, "failed to create temporary file");
 			return -1;
 		}
 	}
 
 	if (!WriteFile(s->post_body, buffer, (DWORD)len, &bytes_written, NULL)) {
-		giterr_set(GITERR_OS, "Failed to write to temporary file");
+		git_error_set(GIT_ERROR_OS, "failed to write to temporary file");
 		return -1;
 	}
 
@@ -773,7 +1333,7 @@ static int winhttp_stream_write_chunked(
 	size_t len)
 {
 	winhttp_stream *s = (winhttp_stream *)stream;
-	winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
+	int error;
 
 	if (!s->request && winhttp_stream_connect(s) < 0)
 		return -1;
@@ -783,17 +1343,12 @@ static int winhttp_stream_write_chunked(
 		if (!WinHttpAddRequestHeaders(s->request,
 			transfer_encoding, (ULONG) -1L,
 			WINHTTP_ADDREQ_FLAG_ADD)) {
-			giterr_set(GITERR_OS, "Failed to add a header to the request");
+			git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
 			return -1;
 		}
 
-		if (!WinHttpSendRequest(s->request,
-			WINHTTP_NO_ADDITIONAL_HEADERS, 0,
-			WINHTTP_NO_REQUEST_DATA, 0,
-			WINHTTP_IGNORE_REQUEST_TOTAL_LENGTH, 0)) {
-			giterr_set(GITERR_OS, "Failed to send request");
-			return -1;
-		}
+		if ((error = send_request(s, 0, 1)) < 0)
+			return error;
 
 		s->sent_request = 1;
 	}
@@ -813,7 +1368,7 @@ static int winhttp_stream_write_chunked(
 	}
 	else {
 		/* Append as much to the buffer as we can */
-		int count = min(CACHED_POST_BODY_BUF_SIZE - s->chunk_buffer_len, (int)len);
+		int count = (int)min(CACHED_POST_BODY_BUF_SIZE - s->chunk_buffer_len, len);
 
 		if (!s->chunk_buffer)
 			s->chunk_buffer = git__malloc(CACHED_POST_BODY_BUF_SIZE);
@@ -845,26 +1400,7 @@ static void winhttp_stream_free(git_smart_subtransport_stream *stream)
 {
 	winhttp_stream *s = (winhttp_stream *)stream;
 
-	if (s->chunk_buffer) {
-		git__free(s->chunk_buffer);
-		s->chunk_buffer = NULL;
-	}
-
-	if (s->post_body) {
-		CloseHandle(s->post_body);
-		s->post_body = NULL;
-	}
-
-	if (s->request_uri) {
-		git__free(s->request_uri);
-		s->request_uri = NULL;
-	}
-
-	if (s->request) {
-		WinHttpCloseHandle(s->request);
-		s->request = NULL;
-	}
-
+	winhttp_stream_close(s);
 	git__free(s);
 }
 
@@ -875,8 +1411,8 @@ static int winhttp_stream_alloc(winhttp_subtransport *t, winhttp_stream **stream
 	if (!stream)
 		return -1;
 
-	s = git__calloc(sizeof(winhttp_stream), 1);
-	GITERR_CHECK_ALLOC(s);
+	s = git__calloc(1, sizeof(winhttp_stream));
+	GIT_ERROR_CHECK_ALLOC(s);
 
 	s->parent.subtransport = &t->parent;
 	s->parent.read = winhttp_stream_read;
@@ -888,72 +1424,12 @@ static int winhttp_stream_alloc(winhttp_subtransport *t, winhttp_stream **stream
 	return 0;
 }
 
-static int winhttp_connect(
-	winhttp_subtransport *t,
-	const char *url)
-{
-	wchar_t *ua = L"git/1.0 (libgit2 " WIDEN(LIBGIT2_VERSION) L")";
-	wchar_t host[GIT_WIN_PATH];
-	int32_t port;
-	const char *default_port = "80";
-	int ret;
-
-	if (!git__prefixcmp(url, prefix_http)) {
-		url = url + strlen(prefix_http);
-		default_port = "80";
-	}
-
-	if (!git__prefixcmp(url, prefix_https)) {
-		url += strlen(prefix_https);
-		default_port = "443";
-		t->use_ssl = 1;
-	}
-
-	if ((ret = gitno_extract_url_parts(&t->host, &t->port, &t->user_from_url,
-					&t->pass_from_url, url, default_port)) < 0)
-		return ret;
-
-	t->path = strchr(url, '/');
-
-	/* Prepare port */
-	if (git__strtol32(&port, t->port, NULL, 10) < 0)
-		return -1;
-
-	/* Prepare host */
-	git__utf8_to_16(host, GIT_WIN_PATH, t->host);
-
-	/* Establish session */
-	t->session = WinHttpOpen(
-			ua,
-			WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
-			WINHTTP_NO_PROXY_NAME,
-			WINHTTP_NO_PROXY_BYPASS,
-			0);
-
-	if (!t->session) {
-		giterr_set(GITERR_OS, "Failed to init WinHTTP");
-		return -1;
-	}
-	
-	/* Establish connection */
-	t->connection = WinHttpConnect(
-			t->session,
-			host,
-			port,
-			0);
-
-	if (!t->connection) {
-		giterr_set(GITERR_OS, "Failed to connect to host");
-		return -1;
-	}
-
-	return 0;
-}
-
 static int winhttp_uploadpack_ls(
 	winhttp_subtransport *t,
 	winhttp_stream *s)
 {
+	GIT_UNUSED(t);
+
 	s->service = upload_pack_service;
 	s->service_url = upload_pack_ls_service_url;
 	s->verb = get_verb;
@@ -965,6 +1441,8 @@ static int winhttp_uploadpack(
 	winhttp_subtransport *t,
 	winhttp_stream *s)
 {
+	GIT_UNUSED(t);
+
 	s->service = upload_pack_service;
 	s->service_url = upload_pack_service_url;
 	s->verb = post_verb;
@@ -976,6 +1454,8 @@ static int winhttp_receivepack_ls(
 	winhttp_subtransport *t,
 	winhttp_stream *s)
 {
+	GIT_UNUSED(t);
+
 	s->service = receive_pack_service;
 	s->service_url = receive_pack_ls_service_url;
 	s->verb = get_verb;
@@ -987,9 +1467,11 @@ static int winhttp_receivepack(
 	winhttp_subtransport *t,
 	winhttp_stream *s)
 {
+	GIT_UNUSED(t);
+
 	/* WinHTTP only supports Transfer-Encoding: chunked
 	 * on Windows Vista (NT 6.0) and higher. */
-	s->chunked = git_has_win32_version(6, 0);
+	s->chunked = git_has_win32_version(6, 0, 0);
 
 	if (s->chunked)
 		s->parent.write = winhttp_stream_write_chunked;
@@ -1013,9 +1495,10 @@ static int winhttp_action(
 	winhttp_stream *s;
 	int ret = -1;
 
-	if (!t->connection &&
-		winhttp_connect(t, url) < 0)
-		return -1;
+	if (!t->connection)
+		if ((ret = gitno_connection_data_from_url(&t->connection_data, url, NULL)) < 0 ||
+			 (ret = winhttp_connect(t)) < 0)
+			return ret;
 
 	if (winhttp_stream_alloc(t, &s) < 0)
 		return -1;
@@ -1054,57 +1537,28 @@ static int winhttp_action(
 static int winhttp_close(git_smart_subtransport *subtransport)
 {
 	winhttp_subtransport *t = (winhttp_subtransport *)subtransport;
-	int ret = 0;
 
-	if (t->host) {
-		git__free(t->host);
-		t->host = NULL;
-	}
-
-	if (t->port) {
-		git__free(t->port);
-		t->port = NULL;
-	}
-
-	if (t->user_from_url) {
-		git__free(t->user_from_url);
-		t->user_from_url = NULL;
-	}
-
-	if (t->pass_from_url) {
-		git__free(t->pass_from_url);
-		t->pass_from_url = NULL;
-	}
+	gitno_connection_data_free_ptrs(&t->connection_data);
+	memset(&t->connection_data, 0x0, sizeof(gitno_connection_data));
+	gitno_connection_data_free_ptrs(&t->proxy_connection_data);
+	memset(&t->proxy_connection_data, 0x0, sizeof(gitno_connection_data));
 
 	if (t->cred) {
 		t->cred->free(t->cred);
 		t->cred = NULL;
 	}
 
+	if (t->proxy_cred) {
+		t->proxy_cred->free(t->proxy_cred);
+		t->proxy_cred = NULL;
+	}
+
 	if (t->url_cred) {
 		t->url_cred->free(t->url_cred);
 		t->url_cred = NULL;
 	}
 
-	if (t->connection) {
-		if (!WinHttpCloseHandle(t->connection)) {
-			giterr_set(GITERR_OS, "Unable to close connection");
-			ret = -1;
-		}
-
-		t->connection = NULL;
-	}
-
-	if (t->session) {
-		if (!WinHttpCloseHandle(t->session)) {
-			giterr_set(GITERR_OS, "Unable to close session");
-			ret = -1;
-		}
-
-		t->session = NULL;
-	}
-
-	return ret;
+	return winhttp_close_connection(t);
 }
 
 static void winhttp_free(git_smart_subtransport *subtransport)
@@ -1116,15 +1570,17 @@ static void winhttp_free(git_smart_subtransport *subtransport)
 	git__free(t);
 }
 
-int git_smart_subtransport_http(git_smart_subtransport **out, git_transport *owner)
+int git_smart_subtransport_http(git_smart_subtransport **out, git_transport *owner, void *param)
 {
 	winhttp_subtransport *t;
 
+	GIT_UNUSED(param);
+
 	if (!out)
 		return -1;
 
-	t = git__calloc(sizeof(winhttp_subtransport), 1);
-	GITERR_CHECK_ALLOC(t);
+	t = git__calloc(1, sizeof(winhttp_subtransport));
+	GIT_ERROR_CHECK_ALLOC(t);
 
 	t->owner = (transport_smart *)owner;
 	t->parent.action = winhttp_action;