rugged 0.27.10 → 0.27.10.1

data/vendor/libgit2/src/transports/ssh.c

@@ -14,14 +14,11 @@
 #include "global.h"
 #include "git2.h"
 #include "buffer.h"
-#include "net.h"
 #include "netops.h"
 #include "smart.h"
+#include "cred.h"
 #include "streams/socket.h"
 
-#include "git2/cred.h"
-#include "git2/sys/cred.h"
-
 #ifdef GIT_SSH
 
 #define OWNING_SUBTRANSPORT(s) ((ssh_subtransport *)(s)->parent.subtransport)
@@ -57,7 +54,7 @@ static void ssh_error(LIBSSH2_SESSION *session, const char *errmsg)
 	char *ssherr;
 	libssh2_session_last_error(session, &ssherr, NULL, 0);
 
-	git_error_set(GIT_ERROR_SSH, "%s: %s", errmsg, ssherr);
+	giterr_set(GITERR_SSH, "%s: %s", errmsg, ssherr);
 }
 
 /*
@@ -88,7 +85,7 @@ static int gen_proto(git_buf *request, const char *cmd, const char *url)
 
 done:
 	if (!repo) {
-		git_error_set(GIT_ERROR_NET, "malformed git protocol URL");
+		giterr_set(GITERR_NET, "malformed git protocol URL");
 		return -1;
 	}
 
@@ -124,7 +121,7 @@ static int send_command(ssh_stream *s)
 	s->sent_command = 1;
 
 cleanup:
-	git_buf_dispose(&request);
+	git_buf_free(&request);
 	return error;
 }
 
@@ -135,7 +132,7 @@ static int ssh_stream_read(
 	size_t *bytes_read)
 {
 	int rc;
-	ssh_stream *s = GIT_CONTAINER_OF(stream, ssh_stream, parent);
+	ssh_stream *s = (ssh_stream *)stream;
 
 	*bytes_read = 0;
 
@@ -154,7 +151,7 @@ static int ssh_stream_read(
 	 */
 	if (rc == 0) {
 		if ((rc = libssh2_channel_read_stderr(s->channel, buffer, buf_size)) > 0) {
-			git_error_set(GIT_ERROR_SSH, "%*s", rc, buffer);
+			giterr_set(GITERR_SSH, "%*s", rc, buffer);
 			return GIT_EEOF;
 		} else if (rc < LIBSSH2_ERROR_NONE) {
 			ssh_error(s->session, "SSH could not read stderr");
@@ -173,7 +170,7 @@ static int ssh_stream_write(
 	const char *buffer,
 	size_t len)
 {
-	ssh_stream *s = GIT_CONTAINER_OF(stream, ssh_stream, parent);
+	ssh_stream *s = (ssh_stream *)stream;
 	size_t off = 0;
 	ssize_t ret = 0;
 
@@ -199,7 +196,7 @@ static int ssh_stream_write(
 
 static void ssh_stream_free(git_smart_subtransport_stream *stream)
 {
-	ssh_stream *s = GIT_CONTAINER_OF(stream, ssh_stream, parent);
+	ssh_stream *s = (ssh_stream *)stream;
 	ssh_subtransport *t;
 
 	if (!stream)
@@ -241,7 +238,7 @@ static int ssh_stream_alloc(
 	assert(stream);
 
 	s = git__calloc(sizeof(ssh_stream), 1);
-	GIT_ERROR_CHECK_ALLOC(s);
+	GITERR_CHECK_ALLOC(s);
 
 	s->parent.subtransport = &t->parent;
 	s->parent.read = ssh_stream_read;
@@ -261,7 +258,8 @@ static int ssh_stream_alloc(
 }
 
 static int git_ssh_extract_url_parts(
-	git_net_url *urldata,
+	char **host,
+	char **username,
 	const char *url)
 {
 	char *colon, *at;
@@ -273,20 +271,20 @@ static int git_ssh_extract_url_parts(
 	at = strchr(url, '@');
 	if (at) {
 		start = at + 1;
-		urldata->username = git__substrdup(url, at - url);
-		GIT_ERROR_CHECK_ALLOC(urldata->username);
+		*username = git__substrdup(url, at - url);
+		GITERR_CHECK_ALLOC(*username);
 	} else {
 		start = url;
-		urldata->username = NULL;
+		*username = NULL;
 	}
 
 	if (colon == NULL || (colon < start)) {
-		git_error_set(GIT_ERROR_NET, "malformed URL");
+		giterr_set(GITERR_NET, "malformed URL");
 		return -1;
 	}
 
-	urldata->host = git__substrdup(start, colon - start);
-	GIT_ERROR_CHECK_ALLOC(urldata->host);
+	*host = git__substrdup(start, colon - start);
+	GITERR_CHECK_ALLOC(*host);
 
 	return 0;
 }
@@ -352,7 +350,7 @@ static int _git_ssh_authenticate_session(
 	int rc;
 
 	do {
-		git_error_clear();
+		giterr_clear();
 		switch (cred->credtype) {
 		case GIT_CREDTYPE_USERPASS_PLAINTEXT: {
 			git_cred_userpass_plaintext *c = (git_cred_userpass_plaintext *)cred;
@@ -430,7 +428,7 @@ static int _git_ssh_authenticate_session(
 			return GIT_EAUTH;
 
 	if (rc != LIBSSH2_ERROR_NONE) {
-		if (!git_error_last())
+		if (!giterr_last())
 			ssh_error(session, "Failed to authenticate SSH session");
 		return -1;
 	}
@@ -449,24 +447,24 @@ static int request_creds(git_cred **out, ssh_subtransport *t, const char *user,
 		error = t->owner->cred_acquire_cb(&cred, t->owner->url, user, auth_methods,
 						  t->owner->cred_acquire_payload);
 
-		if (error == GIT_PASSTHROUGH) {
+		if (error == GIT_PASSTHROUGH)
 			no_callback = 1;
-		} else if (error < 0) {
+		else if (error < 0)
 			return error;
-		} else if (!cred) {
-			git_error_set(GIT_ERROR_SSH, "callback failed to initialize SSH credentials");
+		else if (!cred) {
+			giterr_set(GITERR_SSH, "callback failed to initialize SSH credentials");
 			return -1;
 		}
 	}
 
 	if (no_callback) {
-		git_error_set(GIT_ERROR_SSH, "authentication required but no callback set");
+		giterr_set(GITERR_SSH, "authentication required but no callback set");
 		return -1;
 	}
 
 	if (!(cred->credtype & auth_methods)) {
 		cred->free(cred);
-		git_error_set(GIT_ERROR_SSH, "callback returned unsupported credentials type");
+		giterr_set(GITERR_SSH, "callback returned unsupported credentials type");
 		return -1;
 	}
 
@@ -481,13 +479,13 @@ static int _git_ssh_session_create(
 {
 	int rc = 0;
 	LIBSSH2_SESSION* s;
-	git_socket_stream *socket = GIT_CONTAINER_OF(io, git_socket_stream, parent);
+	git_socket_stream *socket = (git_socket_stream *) io;
 
 	assert(session);
 
 	s = libssh2_session_init();
 	if (!s) {
-		git_error_set(GIT_ERROR_NET, "failed to initialize SSH session");
+		giterr_set(GITERR_NET, "failed to initialize SSH session");
 		return -1;
 	}
 
@@ -508,15 +506,14 @@ static int _git_ssh_session_create(
 	return 0;
 }
 
-#define SSH_DEFAULT_PORT "22"
-
 static int _git_ssh_setup_conn(
 	ssh_subtransport *t,
 	const char *url,
 	const char *cmd,
 	git_smart_subtransport_stream **stream)
 {
-	git_net_url urldata = GIT_NET_URL_INIT;
+	char *host=NULL, *port=NULL, *path=NULL, *user=NULL, *pass=NULL;
+	const char *default_port="22";
 	int auth_methods, error = 0;
 	size_t i;
 	ssh_stream *s;
@@ -538,22 +535,19 @@ static int _git_ssh_setup_conn(
 		const char *p = ssh_prefixes[i];
 
 		if (!git__prefixcmp(url, p)) {
-			if ((error = git_net_url_parse(&urldata, url)) < 0)
+			if ((error = gitno_extract_url_parts(&host, &port, &path, &user, &pass, url, default_port)) < 0)
 				goto done;
 
 			goto post_extract;
 		}
 	}
-	if ((error = git_ssh_extract_url_parts(&urldata, url)) < 0)
+	if ((error = git_ssh_extract_url_parts(&host, &user, url)) < 0)
 		goto done;
-
-	if (urldata.port == NULL)
-		urldata.port = git__strdup(SSH_DEFAULT_PORT);
-
-	GIT_ERROR_CHECK_ALLOC(urldata.port);
+	port = git__strdup(default_port);
+	GITERR_CHECK_ALLOC(port);
 
 post_extract:
-	if ((error = git_socket_stream_new(&s->io, urldata.host, urldata.port)) < 0 ||
+	if ((error = git_socket_stream_new(&s->io, host, port)) < 0 ||
 	    (error = git_stream_connect(s->io)) < 0)
 		goto done;
 
@@ -566,14 +560,6 @@ post_extract:
 
 		cert.parent.cert_type = GIT_CERT_HOSTKEY_LIBSSH2;
 
-#ifdef LIBSSH2_HOSTKEY_HASH_SHA256
-		key = libssh2_hostkey_hash(session, LIBSSH2_HOSTKEY_HASH_SHA256);
-		if (key != NULL) {
-			cert.type |= GIT_CERT_SSH_SHA256;
-			memcpy(&cert.hash_sha256, key, 32);
-		}
-#endif
-
 		key = libssh2_hostkey_hash(session, LIBSSH2_HOSTKEY_HASH_SHA1);
 		if (key != NULL) {
 			cert.type |= GIT_CERT_SSH_SHA1;
@@ -587,42 +573,41 @@ post_extract:
 		}
 
 		if (cert.type == 0) {
-			git_error_set(GIT_ERROR_SSH, "unable to get the host key");
+			giterr_set(GITERR_SSH, "unable to get the host key");
 			error = -1;
 			goto done;
 		}
 
 		/* We don't currently trust any hostkeys */
-		git_error_clear();
+		giterr_clear();
 
 		cert_ptr = &cert;
 
-		error = t->owner->certificate_check_cb((git_cert *) cert_ptr, 0, urldata.host, t->owner->message_cb_payload);
-
-		if (error < 0 && error != GIT_PASSTHROUGH) {
-			if (!git_error_last())
-				git_error_set(GIT_ERROR_NET, "user cancelled hostkey check");
+		error = t->owner->certificate_check_cb((git_cert *) cert_ptr, 0, host, t->owner->message_cb_payload);
+		if (error < 0) {
+			if (!giterr_last())
+				giterr_set(GITERR_NET, "user cancelled hostkey check");
 
 			goto done;
 		}
 	}
 
 	/* we need the username to ask for auth methods */
-	if (!urldata.username) {
+	if (!user) {
 		if ((error = request_creds(&cred, t, NULL, GIT_CREDTYPE_USERNAME)) < 0)
 			goto done;
 
-		urldata.username = git__strdup(((git_cred_username *) cred)->username);
+		user = git__strdup(((git_cred_username *) cred)->username);
 		cred->free(cred);
 		cred = NULL;
-		if (!urldata.username)
+		if (!user)
 			goto done;
-	} else if (urldata.username && urldata.password) {
-		if ((error = git_cred_userpass_plaintext_new(&cred, urldata.username, urldata.password)) < 0)
+	} else if (user && pass) {
+		if ((error = git_cred_userpass_plaintext_new(&cred, user, pass)) < 0)
 			goto done;
 	}
 
-	if ((error = list_auth_methods(&auth_methods, session, urldata.username)) < 0)
+	if ((error = list_auth_methods(&auth_methods, session, user)) < 0)
 		goto done;
 
 	error = GIT_EAUTH;
@@ -636,11 +621,11 @@ post_extract:
 			cred = NULL;
 		}
 
-		if ((error = request_creds(&cred, t, urldata.username, auth_methods)) < 0)
+		if ((error = request_creds(&cred, t, user, auth_methods)) < 0)
 			goto done;
 
-		if (strcmp(urldata.username, git_cred_get_username(cred))) {
-			git_error_set(GIT_ERROR_SSH, "username does not match previous request");
+		if (strcmp(user, git_cred__username(cred))) {
+			giterr_set(GITERR_SSH, "username does not match previous request");
 			error = -1;
 			goto done;
 		}
@@ -676,7 +661,11 @@ done:
 	if (cred)
 		cred->free(cred);
 
-	git_net_url_dispose(&urldata);
+	git__free(host);
+	git__free(port);
+	git__free(path);
+	git__free(user);
+	git__free(pass);
 
 	return error;
 }
@@ -703,7 +692,7 @@ static int ssh_uploadpack(
 		return 0;
 	}
 
-	git_error_set(GIT_ERROR_NET, "must call UPLOADPACK_LS before UPLOADPACK");
+	giterr_set(GITERR_NET, "must call UPLOADPACK_LS before UPLOADPACK");
 	return -1;
 }
 
@@ -730,7 +719,7 @@ static int ssh_receivepack(
 		return 0;
 	}
 
-	git_error_set(GIT_ERROR_NET, "must call RECEIVEPACK_LS before RECEIVEPACK");
+	giterr_set(GITERR_NET, "must call RECEIVEPACK_LS before RECEIVEPACK");
 	return -1;
 }
 
@@ -740,7 +729,7 @@ static int _ssh_action(
 	const char *url,
 	git_smart_service_t action)
 {
-	ssh_subtransport *t = GIT_CONTAINER_OF(subtransport, ssh_subtransport, parent);
+	ssh_subtransport *t = (ssh_subtransport *) subtransport;
 
 	switch (action) {
 		case GIT_SERVICE_UPLOADPACK_LS:
@@ -762,7 +751,7 @@ static int _ssh_action(
 
 static int _ssh_close(git_smart_subtransport *subtransport)
 {
-	ssh_subtransport *t = GIT_CONTAINER_OF(subtransport, ssh_subtransport, parent);
+	ssh_subtransport *t = (ssh_subtransport *) subtransport;
 
 	assert(!t->current_stream);
 
@@ -773,7 +762,7 @@ static int _ssh_close(git_smart_subtransport *subtransport)
 
 static void _ssh_free(git_smart_subtransport *subtransport)
 {
-	ssh_subtransport *t = GIT_CONTAINER_OF(subtransport, ssh_subtransport, parent);
+	ssh_subtransport *t = (ssh_subtransport *) subtransport;
 
 	assert(!t->current_stream);
 
@@ -846,7 +835,7 @@ int git_smart_subtransport_ssh(
 	GIT_UNUSED(param);
 
 	t = git__calloc(sizeof(ssh_subtransport), 1);
-	GIT_ERROR_CHECK_ALLOC(t);
+	GITERR_CHECK_ALLOC(t);
 
 	t->owner = (transport_smart *)owner;
 	t->parent.action = _ssh_action;
@@ -862,7 +851,7 @@ int git_smart_subtransport_ssh(
 	assert(out);
 	*out = NULL;
 
-	git_error_set(GIT_ERROR_INVALID, "cannot create SSH transport. Library was built without SSH support");
+	giterr_set(GITERR_INVALID, "cannot create SSH transport. Library was built without SSH support");
 	return -1;
 #endif
 }
@@ -882,7 +871,7 @@ int git_transport_ssh_with_paths(git_transport **out, git_remote *owner, void *p
 	};
 
 	if (paths->count != 2) {
-		git_error_set(GIT_ERROR_SSH, "invalid ssh paths, must be two strings");
+		giterr_set(GITERR_SSH, "invalid ssh paths, must be two strings");
 		return GIT_EINVALIDSPEC;
 	}
 
@@ -893,9 +882,9 @@ int git_transport_ssh_with_paths(git_transport **out, git_remote *owner, void *p
 	t = (ssh_subtransport *) smart->wrapped;
 
 	t->cmd_uploadpack = git__strdup(paths->strings[0]);
-	GIT_ERROR_CHECK_ALLOC(t->cmd_uploadpack);
+	GITERR_CHECK_ALLOC(t->cmd_uploadpack);
 	t->cmd_receivepack = git__strdup(paths->strings[1]);
-	GIT_ERROR_CHECK_ALLOC(t->cmd_receivepack);
+	GITERR_CHECK_ALLOC(t->cmd_receivepack);
 
 	*out = transport;
 	return 0;
@@ -906,7 +895,7 @@ int git_transport_ssh_with_paths(git_transport **out, git_remote *owner, void *p
 	assert(out);
 	*out = NULL;
 
-	git_error_set(GIT_ERROR_INVALID, "cannot create SSH transport. Library was built without SSH support");
+	giterr_set(GITERR_INVALID, "cannot create SSH transport. Library was built without SSH support");
 	return -1;
 #endif
 }
@@ -922,7 +911,7 @@ int git_transport_ssh_global_init(void)
 {
 #ifdef GIT_SSH
 	if (libssh2_init(0) < 0) {
-		git_error_set(GIT_ERROR_SSH, "unable to initialize libssh2");
+		giterr_set(GITERR_SSH, "unable to initialize libssh2");
 		return -1;
 	}
 

data/vendor/libgit2/src/transports/winhttp.c

@@ -19,7 +19,6 @@
 #include "repository.h"
 #include "global.h"
 #include "http.h"
-#include "git2/sys/cred.h"
 
 #include <wincrypt.h>
 #include <winhttp.h>
@@ -49,14 +48,6 @@
 # define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2 0x00000800
 #endif
 
-#ifndef HTTP_STATUS_PERMANENT_REDIRECT
-# define HTTP_STATUS_PERMANENT_REDIRECT 308
-#endif
-
-#ifndef DWORD_MAX
-# define DWORD_MAX 0xffffffff
-#endif
-
 static const char *prefix_https = "https://";
 static const char *upload_pack_service = "upload-pack";
 static const char *upload_pack_ls_service_url = "/info/refs?service=git-upload-pack";
@@ -109,44 +100,24 @@ typedef struct {
 		chunked : 1;
 } winhttp_stream;
 
-typedef struct {
-	git_net_url url;
-	git_cred *cred;
-	int auth_mechanisms;
-	bool url_cred_presented;
-} winhttp_server;
-
 typedef struct {
 	git_smart_subtransport parent;
 	transport_smart *owner;
-
-	winhttp_server server;
-	winhttp_server proxy;
-
+	gitno_connection_data connection_data;
+	gitno_connection_data proxy_connection_data;
+	git_cred *cred;
+	git_cred *url_cred;
+	git_cred *proxy_cred;
+	int auth_mechanisms;
 	HINTERNET session;
 	HINTERNET connection;
 } winhttp_subtransport;
 
-static int apply_userpass_credentials(HINTERNET request, DWORD target, int mechanisms, git_cred *cred)
+static int _apply_userpass_credential(HINTERNET request, DWORD target, DWORD scheme, git_cred *cred)
 {
 	git_cred_userpass_plaintext *c = (git_cred_userpass_plaintext *)cred;
-	wchar_t *user = NULL, *pass = NULL;
+	wchar_t *user, *pass;
 	int user_len = 0, pass_len = 0, error = 0;
-	DWORD native_scheme;
-
-	if (mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) {
-		native_scheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
-	} else if (mechanisms & GIT_WINHTTP_AUTH_NTLM) {
-		native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
-	} else if (mechanisms & GIT_WINHTTP_AUTH_DIGEST) {
-		native_scheme = WINHTTP_AUTH_SCHEME_DIGEST;
-	} else if (mechanisms & GIT_WINHTTP_AUTH_BASIC) {
-		native_scheme = WINHTTP_AUTH_SCHEME_BASIC;
-	} else {
-		git_error_set(GIT_ERROR_NET, "invalid authentication scheme");
-		error = -1;
-		goto done;
-	}
 
 	if ((error = user_len = git__utf8_to_16_alloc(&user, c->username)) < 0)
 		goto done;
@@ -154,8 +125,8 @@ static int apply_userpass_credentials(HINTERNET request, DWORD target, int mecha
 	if ((error = pass_len = git__utf8_to_16_alloc(&pass, c->password)) < 0)
 		goto done;
 
-	if (!WinHttpSetCredentials(request, target, native_scheme, user, pass, NULL)) {
-		git_error_set(GIT_ERROR_OS, "failed to set credentials");
+	if (!WinHttpSetCredentials(request, target, scheme, user, pass, NULL)) {
+		giterr_set(GITERR_OS, "failed to set credentials");
 		error = -1;
 	}
 
@@ -172,74 +143,90 @@ done:
 	return error;
 }
 
-static int apply_default_credentials(HINTERNET request, DWORD target, int mechanisms)
+static int apply_userpass_credential_proxy(HINTERNET request, git_cred *cred, int mechanisms)
 {
-	DWORD autologon_level = WINHTTP_AUTOLOGON_SECURITY_LEVEL_LOW;
-	DWORD native_scheme = 0;
+	if (GIT_WINHTTP_AUTH_DIGEST & mechanisms) {
+		return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_PROXY,
+			WINHTTP_AUTH_SCHEME_DIGEST, cred);
+	}
+
+	return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_PROXY,
+		WINHTTP_AUTH_SCHEME_BASIC, cred);
+}
+
+static int apply_userpass_credential(HINTERNET request, int mechanisms, git_cred *cred)
+{
+	DWORD native_scheme;
 
-	if ((mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) != 0) {
-		native_scheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
-	} else if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) != 0) {
+	if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) ||
+		(mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE)) {
 		native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
+	} else if (mechanisms & GIT_WINHTTP_AUTH_BASIC) {
+		native_scheme = WINHTTP_AUTH_SCHEME_BASIC;
 	} else {
-		git_error_set(GIT_ERROR_NET, "invalid authentication scheme");
+		giterr_set(GITERR_NET, "invalid authentication scheme");
 		return -1;
 	}
 
-	/*
-	 * Autologon policy must be "low" to use default creds.
-	 * This is safe as the user has explicitly requested it.
-	 */
-	if (!WinHttpSetOption(request, WINHTTP_OPTION_AUTOLOGON_POLICY, &autologon_level, sizeof(DWORD))) {
-		git_error_set(GIT_ERROR_OS, "could not configure logon policy");
-		return -1;
-	}
+	return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_SERVER,
+		native_scheme, cred);
+}
 
-	if (!WinHttpSetCredentials(request, target, native_scheme, NULL, NULL, NULL)) {
-		git_error_set(GIT_ERROR_OS, "could not configure credentials");
+static int apply_default_credentials(HINTERNET request, int mechanisms)
+{
+	/* Either the caller explicitly requested that default credentials be passed,
+	 * or our fallback credential callback was invoked and checked that the target
+	 * URI was in the appropriate Internet Explorer security zone. By setting this
+	 * flag, we guarantee that the credentials are delivered by WinHTTP. The default
+	 * is "medium" which applies to the intranet and sounds like it would correspond
+	 * to Internet Explorer security zones, but in fact does not. */
+	DWORD data = WINHTTP_AUTOLOGON_SECURITY_LEVEL_LOW;
+	DWORD native_scheme = 0;
+
+	if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) != 0)
+		native_scheme |= WINHTTP_AUTH_SCHEME_NTLM;
+
+	if ((mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) != 0)
+		native_scheme |= WINHTTP_AUTH_SCHEME_NEGOTIATE;
+
+	if (!native_scheme) {
+		giterr_set(GITERR_NET, "invalid authentication scheme");
 		return -1;
 	}
 
-	return 0;
-}
-
-static int acquire_url_cred(
-	git_cred **cred,
-	unsigned int allowed_types,
-	const char *username,
-	const char *password)
-{
-	if (allowed_types & GIT_CREDTYPE_USERPASS_PLAINTEXT)
-		return git_cred_userpass_plaintext_new(cred, username, password);
+	if (!WinHttpSetOption(request, WINHTTP_OPTION_AUTOLOGON_POLICY, &data, sizeof(DWORD)))
+		return -1;
 
-	if ((allowed_types & GIT_CREDTYPE_DEFAULT) && *username == '\0' && *password == '\0')
-		return git_cred_default_new(cred);
+	if (!WinHttpSetCredentials(request, WINHTTP_AUTH_TARGET_SERVER, native_scheme, NULL, NULL, NULL))
+		return -1;
 
-	return 1;
+	return 0;
 }
 
-static int acquire_fallback_cred(
+static int fallback_cred_acquire_cb(
 	git_cred **cred,
 	const char *url,
-	unsigned int allowed_types)
+	const char *username_from_url,
+	unsigned int allowed_types,
+	void *payload)
 {
 	int error = 1;
 
+	GIT_UNUSED(username_from_url);
+	GIT_UNUSED(payload);
+
 	/* If the target URI supports integrated Windows authentication
 	 * as an authentication mechanism */
 	if (GIT_CREDTYPE_DEFAULT & allowed_types) {
 		wchar_t *wide_url;
-		HRESULT hCoInitResult;
 
 		/* Convert URL to wide characters */
 		if (git__utf8_to_16_alloc(&wide_url, url) < 0) {
-			git_error_set(GIT_ERROR_OS, "failed to convert string to wide form");
+			giterr_set(GITERR_OS, "failed to convert string to wide form");
 			return -1;
 		}
 
-		hCoInitResult = CoInitializeEx(NULL, COINIT_MULTITHREADED);
-
-		if (SUCCEEDED(hCoInitResult) || hCoInitResult == RPC_E_CHANGED_MODE) {
+		if (SUCCEEDED(CoInitializeEx(NULL, COINIT_MULTITHREADED))) {
 			IInternetSecurityManager* pISM;
 
 			/* And if the target URI is in the My Computer, Intranet, or Trusted zones */
@@ -263,9 +250,7 @@ static int acquire_fallback_cred(
 				pISM->lpVtbl->Release(pISM);
 			}
 
-			/* Only unitialize if the call to CoInitializeEx was successful. */
-			if (SUCCEEDED(hCoInitResult))
-				CoUninitialize();
+			CoUninitialize();
 		}
 
 		git__free(wide_url);
@@ -284,32 +269,29 @@ static int certificate_check(winhttp_stream *s, int valid)
 
 	/* If there is no override, we should fail if WinHTTP doesn't think it's fine */
 	if (t->owner->certificate_check_cb == NULL && !valid) {
-		if (!git_error_last())
-			git_error_set(GIT_ERROR_NET, "unknown certificate check failure");
+		if (!giterr_last())
+			giterr_set(GITERR_NET, "unknown certificate check failure");
 
 		return GIT_ECERTIFICATE;
 	}
 
-	if (t->owner->certificate_check_cb == NULL || git__strcmp(t->server.url.scheme, "https") != 0)
+	if (t->owner->certificate_check_cb == NULL || !t->connection_data.use_ssl)
 		return 0;
 
 	if (!WinHttpQueryOption(s->request, WINHTTP_OPTION_SERVER_CERT_CONTEXT, &cert_ctx, &cert_ctx_size)) {
-		git_error_set(GIT_ERROR_OS, "failed to get server certificate");
+		giterr_set(GITERR_OS, "failed to get server certificate");
 		return -1;
 	}
 
-	git_error_clear();
+	giterr_clear();
 	cert.parent.cert_type = GIT_CERT_X509;
 	cert.data = cert_ctx->pbCertEncoded;
 	cert.len = cert_ctx->cbCertEncoded;
-	error = t->owner->certificate_check_cb((git_cert *) &cert, valid, t->server.url.host, t->owner->message_cb_payload);
+	error = t->owner->certificate_check_cb((git_cert *) &cert, valid, t->connection_data.host, t->owner->message_cb_payload);
 	CertFreeCertificateContext(cert_ctx);
 
-	if (error == GIT_PASSTHROUGH)
-		error = valid ? 0 : GIT_ECERTIFICATE;
-
-	if (error < 0 && !git_error_last())
-		git_error_set(GIT_ERROR_NET, "user cancelled certificate check");
+	if (error < 0 && !giterr_last())
+		giterr_set(GITERR_NET, "user cancelled certificate check");
 
 	return error;
 }
@@ -339,26 +321,37 @@ static void winhttp_stream_close(winhttp_stream *s)
 	s->sent_request = 0;
 }
 
-static int apply_credentials(
-	HINTERNET request,
-	git_net_url *url,
-	int target,
-	git_cred *creds,
-	int mechanisms)
+/**
+ * Extract the url and password from a URL. The outputs are pointers
+ * into the input.
+ */
+static int userpass_from_url(wchar_t **user, int *user_len,
+			     wchar_t **pass, int *pass_len,
+			     const wchar_t *url, int url_len)
 {
-	int error = 0;
+	URL_COMPONENTS components = { 0 };
 
-	GIT_UNUSED(url);
+	components.dwStructSize = sizeof(components);
+	/* These tell WinHttpCrackUrl that we're interested in the fields */
+	components.dwUserNameLength = 1;
+	components.dwPasswordLength = 1;
 
-	/* If we have creds, just apply them */
-	if (creds && creds->credtype == GIT_CREDTYPE_USERPASS_PLAINTEXT)
-		error = apply_userpass_credentials(request, target, mechanisms, creds);
-	else if (creds && creds->credtype == GIT_CREDTYPE_DEFAULT)
-		error = apply_default_credentials(request, target, mechanisms);
+	if (!WinHttpCrackUrl(url, url_len, 0, &components)) {
+		giterr_set(GITERR_OS, "failed to extract user/pass from url");
+		return -1;
+	}
 
-	return error;
+	*user     = components.lpszUserName;
+	*user_len = components.dwUserNameLength;
+	*pass     = components.lpszPassword;
+	*pass_len = components.dwPasswordLength;
+
+	return 0;
 }
 
+#define SCHEME_HTTP  "http://"
+#define SCHEME_HTTPS "https://"
+
 static int winhttp_stream_connect(winhttp_stream *s)
 {
 	winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
@@ -371,20 +364,18 @@ static int winhttp_stream_connect(winhttp_stream *s)
 	unsigned long disable_redirects = WINHTTP_DISABLE_REDIRECTS;
 	int default_timeout = TIMEOUT_INFINITE;
 	int default_connect_timeout = DEFAULT_CONNECT_TIMEOUT;
-	DWORD autologon_policy = WINHTTP_AUTOLOGON_SECURITY_LEVEL_HIGH;
-
 	size_t i;
 	const git_proxy_options *proxy_opts;
 
 	/* Prepare URL */
-	git_buf_printf(&buf, "%s%s", t->server.url.path, s->service_url);
+	git_buf_printf(&buf, "%s%s", t->connection_data.path, s->service_url);
 
 	if (git_buf_oom(&buf))
 		return -1;
 
 	/* Convert URL to wide characters */
 	if (git__utf8_to_16_alloc(&s->request_uri, git_buf_cstr(&buf)) < 0) {
-		git_error_set(GIT_ERROR_OS, "failed to convert string to wide form");
+		giterr_set(GITERR_OS, "failed to convert string to wide form");
 		goto on_error;
 	}
 
@@ -396,31 +387,27 @@ static int winhttp_stream_connect(winhttp_stream *s)
 			NULL,
 			WINHTTP_NO_REFERER,
 			types,
-			git__strcmp(t->server.url.scheme, "https") == 0 ? WINHTTP_FLAG_SECURE : 0);
+			t->connection_data.use_ssl ? WINHTTP_FLAG_SECURE : 0);
 
 	if (!s->request) {
-		git_error_set(GIT_ERROR_OS, "failed to open request");
+		giterr_set(GITERR_OS, "failed to open request");
 		goto on_error;
 	}
 
-	/* Never attempt default credentials; we'll provide them explicitly. */
-	if (!WinHttpSetOption(s->request, WINHTTP_OPTION_AUTOLOGON_POLICY, &autologon_policy, sizeof(DWORD)))
-		return -1;
-
 	if (!WinHttpSetTimeouts(s->request, default_timeout, default_connect_timeout, default_timeout, default_timeout)) {
-		git_error_set(GIT_ERROR_OS, "failed to set timeouts for WinHTTP");
+		giterr_set(GITERR_OS, "failed to set timeouts for WinHTTP");
 		goto on_error;
 	}
 
 	proxy_opts = &t->owner->proxy;
 	if (proxy_opts->type == GIT_PROXY_AUTO) {
 		/* Set proxy if necessary */
-		if (git_remote__get_http_proxy(t->owner->owner, (strcmp(t->server.url.scheme, "https") == 0), &proxy_url) < 0)
+		if (git_remote__get_http_proxy(t->owner->owner, !!t->connection_data.use_ssl, &proxy_url) < 0)
 			goto on_error;
 	}
 	else if (proxy_opts->type == GIT_PROXY_SPECIFIED) {
 		proxy_url = git__strdup(proxy_opts->url);
-		GIT_ERROR_CHECK_ALLOC(proxy_url);
+		GITERR_CHECK_ALLOC(proxy_url);
 	}
 
 	if (proxy_url) {
@@ -428,24 +415,38 @@ static int winhttp_stream_connect(winhttp_stream *s)
 		WINHTTP_PROXY_INFO proxy_info;
 		wchar_t *proxy_wide;
 
-		git_net_url_dispose(&t->proxy.url);
+		if (!git__prefixcmp(proxy_url, SCHEME_HTTP)) {
+			t->proxy_connection_data.use_ssl = false;
+		} else if (!git__prefixcmp(proxy_url, SCHEME_HTTPS)) {
+			t->proxy_connection_data.use_ssl = true;
+		} else {
+			giterr_set(GITERR_NET, "invalid URL: '%s'", proxy_url);
+			return -1;
+		}
+
+		gitno_connection_data_free_ptrs(&t->proxy_connection_data);
 
-		if ((error = git_net_url_parse(&t->proxy.url, proxy_url)) < 0)
+		if ((error = gitno_extract_url_parts(&t->proxy_connection_data.host, &t->proxy_connection_data.port, NULL,
+				&t->proxy_connection_data.user, &t->proxy_connection_data.pass, proxy_url, NULL)) < 0)
 			goto on_error;
 
-		if (strcmp(t->proxy.url.scheme, "http") != 0 && strcmp(t->proxy.url.scheme, "https") != 0) {
-			git_error_set(GIT_ERROR_NET, "invalid URL: '%s'", proxy_url);
-			error = -1;
-			goto on_error;
-		}
+		if (t->proxy_connection_data.user && t->proxy_connection_data.pass) {
+			if (t->proxy_cred) {
+				t->proxy_cred->free(t->proxy_cred);
+			}
 
-		git_buf_puts(&processed_url, t->proxy.url.scheme);
-		git_buf_PUTS(&processed_url, "://");
+			if ((error = git_cred_userpass_plaintext_new(&t->proxy_cred, t->proxy_connection_data.user, t->proxy_connection_data.pass)) < 0)
+				goto on_error;
+		}
 
-		git_buf_puts(&processed_url, t->proxy.url.host);
+		if (t->proxy_connection_data.use_ssl)
+			git_buf_PUTS(&processed_url, SCHEME_HTTPS);
+		else
+			git_buf_PUTS(&processed_url, SCHEME_HTTP);
 
-		if (!git_net_url_is_default_port(&t->proxy.url))
-			git_buf_printf(&processed_url, ":%s", t->proxy.url.port);
+		git_buf_puts(&processed_url, t->proxy_connection_data.host);
+		if (t->proxy_connection_data.port)
+			git_buf_printf(&processed_url, ":%s", t->proxy_connection_data.port);
 
 		if (git_buf_oom(&processed_url)) {
 			error = -1;
@@ -454,7 +455,7 @@ static int winhttp_stream_connect(winhttp_stream *s)
 
 		/* Convert URL to wide characters */
 		error = git__utf8_to_16_alloc(&proxy_wide, processed_url.ptr);
-		git_buf_dispose(&processed_url);
+		git_buf_free(&processed_url);
 		if (error < 0)
 			goto on_error;
 
@@ -466,15 +467,20 @@ static int winhttp_stream_connect(winhttp_stream *s)
 			WINHTTP_OPTION_PROXY,
 			&proxy_info,
 			sizeof(WINHTTP_PROXY_INFO))) {
-			git_error_set(GIT_ERROR_OS, "failed to set proxy");
+			giterr_set(GITERR_OS, "failed to set proxy");
 			git__free(proxy_wide);
 			goto on_error;
 		}
 
 		git__free(proxy_wide);
 
-		if ((error = apply_credentials(s->request, &t->proxy.url, WINHTTP_AUTH_TARGET_PROXY, t->proxy.cred, t->proxy.auth_mechanisms)) < 0)
-			goto on_error;
+		if (t->proxy_cred) {
+			if (t->proxy_cred->credtype == GIT_CREDTYPE_USERPASS_PLAINTEXT) {
+				if ((error = apply_userpass_credential_proxy(s->request, t->proxy_cred, t->auth_mechanisms)) < 0)
+					goto on_error;
+			}
+		}
+
 	}
 
 	/* Disable WinHTTP redirects so we can handle them manually. Why, you ask?
@@ -484,8 +490,7 @@ static int winhttp_stream_connect(winhttp_stream *s)
 		WINHTTP_OPTION_DISABLE_FEATURE,
 		&disable_redirects,
 		sizeof(disable_redirects))) {
-			git_error_set(GIT_ERROR_OS, "failed to disable redirects");
-			error = -1;
+			giterr_set(GITERR_OS, "failed to disable redirects");
 			goto on_error;
 	}
 
@@ -499,7 +504,7 @@ static int winhttp_stream_connect(winhttp_stream *s)
 
 	/* Send Pragma: no-cache header */
 	if (!WinHttpAddRequestHeaders(s->request, pragma_nocache, (ULONG) -1L, WINHTTP_ADDREQ_FLAG_ADD)) {
-		git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
+		giterr_set(GITERR_OS, "failed to add a header to the request");
 		goto on_error;
 	}
 
@@ -512,13 +517,13 @@ static int winhttp_stream_connect(winhttp_stream *s)
 			goto on_error;
 
 		if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_buf_cstr(&buf)) < 0) {
-			git_error_set(GIT_ERROR_OS, "failed to convert content-type to wide characters");
+			giterr_set(GITERR_OS, "failed to convert content-type to wide characters");
 			goto on_error;
 		}
 
 		if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
 			WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
-			git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
+			giterr_set(GITERR_OS, "failed to add a header to the request");
 			goto on_error;
 		}
 
@@ -529,13 +534,13 @@ static int winhttp_stream_connect(winhttp_stream *s)
 			goto on_error;
 
 		if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_buf_cstr(&buf)) < 0) {
-			git_error_set(GIT_ERROR_OS, "failed to convert accept header to wide characters");
+			giterr_set(GITERR_OS, "failed to convert accept header to wide characters");
 			goto on_error;
 		}
 
 		if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
 			WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
-			git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
+			giterr_set(GITERR_OS, "failed to add a header to the request");
 			goto on_error;
 		}
 	}
@@ -545,28 +550,45 @@ static int winhttp_stream_connect(winhttp_stream *s)
 			git_buf_clear(&buf);
 			git_buf_puts(&buf, t->owner->custom_headers.strings[i]);
 			if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_buf_cstr(&buf)) < 0) {
-				git_error_set(GIT_ERROR_OS, "failed to convert custom header to wide characters");
+				giterr_set(GITERR_OS, "failed to convert custom header to wide characters");
 				goto on_error;
 			}
 
 			if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
 				WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
-				git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
+				giterr_set(GITERR_OS, "failed to add a header to the request");
 				goto on_error;
 			}
 		}
 	}
 
 	/* If requested, disable certificate validation */
-	if (strcmp(t->server.url.scheme, "https") == 0) {
+	if (t->connection_data.use_ssl) {
 		int flags;
 
 		if (t->owner->parent.read_flags(&t->owner->parent, &flags) < 0)
 			goto on_error;
 	}
 
-	if ((error = apply_credentials(s->request, &t->server.url, WINHTTP_AUTH_TARGET_SERVER, t->server.cred, t->server.auth_mechanisms)) < 0)
+	/* If we have a credential on the subtransport, apply it to the request */
+	if (t->cred &&
+		t->cred->credtype == GIT_CREDTYPE_USERPASS_PLAINTEXT &&
+		apply_userpass_credential(s->request, t->auth_mechanisms, t->cred) < 0)
 		goto on_error;
+	else if (t->cred &&
+		t->cred->credtype == GIT_CREDTYPE_DEFAULT &&
+		apply_default_credentials(s->request, t->auth_mechanisms) < 0)
+		goto on_error;
+
+	/* If no other credentials have been applied and the URL has username and
+	 * password, use those */
+	if (!t->cred && t->connection_data.user && t->connection_data.pass) {
+		if (!t->url_cred &&
+			git_cred_userpass_plaintext_new(&t->url_cred, t->connection_data.user, t->connection_data.pass) < 0)
+			goto on_error;
+		if (apply_userpass_credential(s->request, GIT_WINHTTP_AUTH_BASIC, t->url_cred) < 0)
+			goto on_error;
+	}
 
 	/* We've done everything up to calling WinHttpSendRequest. */
 
@@ -577,14 +599,14 @@ on_error:
 		winhttp_stream_close(s);
 
 	git__free(proxy_url);
-	git_buf_dispose(&buf);
+	git_buf_free(&buf);
 	return error;
 }
 
 static int parse_unauthorized_response(
+	HINTERNET request,
 	int *allowed_types,
-	int *allowed_mechanisms,
-	HINTERNET request)
+	int *allowed_mechanisms)
 {
 	DWORD supported, first, target;
 
@@ -595,7 +617,7 @@ static int parse_unauthorized_response(
 	 * We can assume this was already done, since we know we are unauthorized.
 	 */
 	if (!WinHttpQueryAuthSchemes(request, &supported, &first, &target)) {
-		git_error_set(GIT_ERROR_OS, "failed to parse supported auth schemes");
+		giterr_set(GITERR_OS, "failed to parse supported auth schemes");
 		return -1;
 	}
 
@@ -629,7 +651,7 @@ static int write_chunk(HINTERNET request, const char *buffer, size_t len)
 	git_buf buf = GIT_BUF_INIT;
 
 	/* Chunk header */
-	git_buf_printf(&buf, "%"PRIXZ"\r\n", len);
+	git_buf_printf(&buf, "%X\r\n", len);
 
 	if (git_buf_oom(&buf))
 		return -1;
@@ -637,18 +659,18 @@ static int write_chunk(HINTERNET request, const char *buffer, size_t len)
 	if (!WinHttpWriteData(request,
 		git_buf_cstr(&buf),	(DWORD)git_buf_len(&buf),
 		&bytes_written)) {
-		git_buf_dispose(&buf);
-		git_error_set(GIT_ERROR_OS, "failed to write chunk header");
+		git_buf_free(&buf);
+		giterr_set(GITERR_OS, "failed to write chunk header");
 		return -1;
 	}
 
-	git_buf_dispose(&buf);
+	git_buf_free(&buf);
 
 	/* Chunk body */
 	if (!WinHttpWriteData(request,
 		buffer, (DWORD)len,
 		&bytes_written)) {
-		git_error_set(GIT_ERROR_OS, "failed to write chunk");
+		giterr_set(GITERR_OS, "failed to write chunk");
 		return -1;
 	}
 
@@ -656,7 +678,7 @@ static int write_chunk(HINTERNET request, const char *buffer, size_t len)
 	if (!WinHttpWriteData(request,
 		"\r\n", 2,
 		&bytes_written)) {
-		git_error_set(GIT_ERROR_OS, "failed to write chunk footer");
+		giterr_set(GITERR_OS, "failed to write chunk footer");
 		return -1;
 	}
 
@@ -669,7 +691,7 @@ static int winhttp_close_connection(winhttp_subtransport *t)
 
 	if (t->connection) {
 		if (!WinHttpCloseHandle(t->connection)) {
-			git_error_set(GIT_ERROR_OS, "unable to close connection");
+			giterr_set(GITERR_OS, "unable to close connection");
 			ret = -1;
 		}
 
@@ -678,7 +700,7 @@ static int winhttp_close_connection(winhttp_subtransport *t)
 
 	if (t->session) {
 		if (!WinHttpCloseHandle(t->session)) {
-			git_error_set(GIT_ERROR_OS, "unable to close session");
+			giterr_set(GITERR_OS, "unable to close session");
 			ret = -1;
 		}
 
@@ -697,31 +719,27 @@ static void CALLBACK winhttp_status(
 {
 	DWORD status;
 
-	GIT_UNUSED(connection);
-	GIT_UNUSED(ctx);
-	GIT_UNUSED(info_len);
-
 	if (code != WINHTTP_CALLBACK_STATUS_SECURE_FAILURE)
 		return;
 
 	status = *((DWORD *)info);
 
 	if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_CN_INVALID))
-		git_error_set(GIT_ERROR_NET, "SSL certificate issued for different common name");
+		giterr_set(GITERR_NET, "SSL certificate issued for different common name");
 	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_DATE_INVALID))
-		git_error_set(GIT_ERROR_NET, "SSL certificate has expired");
+		giterr_set(GITERR_NET, "SSL certificate has expired");
 	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA))
-		git_error_set(GIT_ERROR_NET, "SSL certificate signed by unknown CA");
+		giterr_set(GITERR_NET, "SSL certificate signed by unknown CA");
 	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CERT))
-		git_error_set(GIT_ERROR_NET, "SSL certificate is invalid");
+		giterr_set(GITERR_NET, "SSL certificate is invalid");
 	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED))
-		git_error_set(GIT_ERROR_NET, "certificate revocation check failed");
+		giterr_set(GITERR_NET, "certificate revocation check failed");
 	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_REVOKED))
-		git_error_set(GIT_ERROR_NET, "SSL certificate was revoked");
+		giterr_set(GITERR_NET, "SSL certificate was revoked");
 	else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR))
-		git_error_set(GIT_ERROR_NET, "security libraries could not be loaded");
+		giterr_set(GITERR_NET, "security libraries could not be loaded");
 	else
-		git_error_set(GIT_ERROR_NET, "unknown security error %lu", status);
+		giterr_set(GITERR_NET, "unknown security error %d", status);
 }
 
 static int winhttp_connect(
@@ -743,13 +761,13 @@ static int winhttp_connect(
 	t->connection = NULL;
 
 	/* Prepare port */
-	if (git__strntol32(&port, t->server.url.port,
-			   strlen(t->server.url.port), NULL, 10) < 0)
+	if (git__strntol32(&port, t->connection_data.port,
+			   strlen(t->connection_data.port), NULL, 10) < 0)
 		return -1;
 
 	/* Prepare host */
-	if (git__utf8_to_16_alloc(&wide_host, t->server.url.host) < 0) {
-		git_error_set(GIT_ERROR_OS, "unable to convert host to wide characters");
+	if (git__utf8_to_16_alloc(&wide_host, t->connection_data.host) < 0) {
+		giterr_set(GITERR_OS, "unable to convert host to wide characters");
 		return -1;
 	}
 
@@ -760,13 +778,13 @@ static int winhttp_connect(
 	}
 
 	if (git__utf8_to_16_alloc(&wide_ua, git_buf_cstr(&ua)) < 0) {
-		git_error_set(GIT_ERROR_OS, "unable to convert host to wide characters");
+		giterr_set(GITERR_OS, "unable to convert host to wide characters");
 		git__free(wide_host);
-		git_buf_dispose(&ua);
+		git_buf_free(&ua);
 		return -1;
 	}
 
-	git_buf_dispose(&ua);
+	git_buf_free(&ua);
 
 	/* Establish session */
 	t->session = WinHttpOpen(
@@ -777,7 +795,7 @@ static int winhttp_connect(
 		0);
 
 	if (!t->session) {
-		git_error_set(GIT_ERROR_OS, "failed to init WinHTTP");
+		giterr_set(GITERR_OS, "failed to init WinHTTP");
 		goto on_error;
 	}
 
@@ -792,7 +810,7 @@ static int winhttp_connect(
 		sizeof(protocols));
 
 	if (!WinHttpSetTimeouts(t->session, default_timeout, default_connect_timeout, default_timeout, default_timeout)) {
-		git_error_set(GIT_ERROR_OS, "failed to set timeouts for WinHTTP");
+		giterr_set(GITERR_OS, "failed to set timeouts for WinHTTP");
 		goto on_error;
 	}
 
@@ -805,12 +823,12 @@ static int winhttp_connect(
 		0);
 
 	if (!t->connection) {
-		git_error_set(GIT_ERROR_OS, "failed to connect to host");
+		giterr_set(GITERR_OS, "failed to connect to host");
 		goto on_error;
 	}
 
 	if (WinHttpSetStatusCallback(t->connection, winhttp_status, WINHTTP_CALLBACK_FLAG_SECURE_FAILURE, 0) == WINHTTP_INVALID_STATUS_CALLBACK) {
-		git_error_set(GIT_ERROR_OS, "failed to set status callback");
+		giterr_set(GITERR_OS, "failed to set status callback");
 		goto on_error;
 	}
 
@@ -831,11 +849,6 @@ static int do_send_request(winhttp_stream *s, size_t len, int ignore_length)
 	int attempts;
 	bool success;
 
-	if (len > DWORD_MAX) {
-		SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-		return -1;
-	}
-
 	for (attempts = 0; attempts < 5; attempts++) {
 		if (ignore_length) {
 			success = WinHttpSendRequest(s->request,
@@ -846,10 +859,10 @@ static int do_send_request(winhttp_stream *s, size_t len, int ignore_length)
 			success = WinHttpSendRequest(s->request,
 				WINHTTP_NO_ADDITIONAL_HEADERS, 0,
 				WINHTTP_NO_REQUEST_DATA, 0,
-				(DWORD)len, 0);
+				len, 0);
 		}
 
-		if (success || GetLastError() != (DWORD)SEC_E_BUFFER_TOO_SMALL)
+		if (success || GetLastError() != SEC_E_BUFFER_TOO_SMALL)
 			break;
 	}
 
@@ -861,10 +874,10 @@ static int send_request(winhttp_stream *s, size_t len, int ignore_length)
 	int request_failed = 0, cert_valid = 1, error = 0;
 	DWORD ignore_flags;
 
-	git_error_clear();
+	giterr_clear();
 	if ((error = do_send_request(s, len, ignore_length)) < 0) {
 		if (GetLastError() != ERROR_WINHTTP_SECURE_FAILURE) {
-			git_error_set(GIT_ERROR_OS, "failed to send request");
+			giterr_set(GITERR_OS, "failed to send request");
 			return -1;
 		}
 
@@ -872,10 +885,10 @@ static int send_request(winhttp_stream *s, size_t len, int ignore_length)
 		cert_valid = 0;
 	}
 
-	git_error_clear();
+	giterr_clear();
 	if ((error = certificate_check(s, cert_valid)) < 0) {
-		if (!git_error_last())
-			git_error_set(GIT_ERROR_OS, "user cancelled certificate check");
+		if (!giterr_last())
+			giterr_set(GITERR_OS, "user cancelled certificate check");
 
 		return error;
 	}
@@ -887,69 +900,16 @@ static int send_request(winhttp_stream *s, size_t len, int ignore_length)
 	ignore_flags = no_check_cert_flags;
 
 	if (!WinHttpSetOption(s->request, WINHTTP_OPTION_SECURITY_FLAGS, &ignore_flags, sizeof(ignore_flags))) {
-		git_error_set(GIT_ERROR_OS, "failed to set security options");
+		giterr_set(GITERR_OS, "failed to set security options");
 		return -1;
 	}
 
 	if ((error = do_send_request(s, len, ignore_length)) < 0)
-		git_error_set(GIT_ERROR_OS, "failed to send request with unchecked certificate");
+		giterr_set(GITERR_OS, "failed to send request with unchecked certificate");
 
 	return error;
 }
 
-static int acquire_credentials(
-	HINTERNET request,
-	winhttp_server *server,
-	const char *url_str,
-	git_cred_acquire_cb cred_cb,
-	void *cred_cb_payload)
-{
-	int allowed_types;
-	int error = 1;
-
-	if (parse_unauthorized_response(&allowed_types, &server->auth_mechanisms, request) < 0)
-		return -1;
-
-	if (allowed_types) {
-		git_cred_free(server->cred);
-		server->cred = NULL;
-
-		/* Start with URL-specified credentials, if there were any. */
-		if (!server->url_cred_presented && server->url.username && server->url.password) {
-			error = acquire_url_cred(&server->cred, allowed_types, server->url.username, server->url.password);
-			server->url_cred_presented = 1;
-
-			if (error < 0)
-				return error;
-		}
-
-		/* Next use the user-defined callback, if there is one. */
-		if (error > 0 && cred_cb) {
-			error = cred_cb(&server->cred, url_str, server->url.username, allowed_types, cred_cb_payload);
-
-			/* Treat GIT_PASSTHROUGH as though git_cred_acquire_cb isn't set */
-			if (error == GIT_PASSTHROUGH)
-				error = 1;
-			else if (error < 0)
-				return error;
-		}
-
-		/* Finally, invoke the fallback default credential lookup. */
-		if (error > 0) {
-			error = acquire_fallback_cred(&server->cred, url_str, allowed_types);
-
-			if (error < 0)
-				return error;
-		}
-	}
-
-	/*
-	 * No error occurred but we could not find appropriate credentials.
-	 * This behaves like a pass-through.
-	 */
-	return error;
-}
-
 static int winhttp_stream_read(
 	git_smart_subtransport_stream *stream,
 	char *buffer,
@@ -964,8 +924,8 @@ static int winhttp_stream_read(
 
 replay:
 	/* Enforce a reasonable cap on the number of replays */
-	if (replay_count++ >= GIT_HTTP_REPLAY_MAX) {
-		git_error_set(GIT_ERROR_NET, "too many redirects or authentication replays");
+	if (++replay_count >= 7) {
+		giterr_set(GITERR_NET, "too many redirects or authentication replays");
 		return -1;
 	}
 
@@ -1000,7 +960,7 @@ replay:
 			if (!WinHttpWriteData(s->request,
 				"0\r\n\r\n", 5,
 				&bytes_written)) {
-				git_error_set(GIT_ERROR_OS, "failed to write final chunk");
+				giterr_set(GITERR_OS, "failed to write final chunk");
 				return -1;
 			}
 		}
@@ -1011,12 +971,11 @@ replay:
 			if (INVALID_SET_FILE_POINTER == SetFilePointer(s->post_body,
 					0, 0, FILE_BEGIN) &&
 				NO_ERROR != GetLastError()) {
-				git_error_set(GIT_ERROR_OS, "failed to reset file pointer");
+				giterr_set(GITERR_OS, "failed to reset file pointer");
 				return -1;
 			}
 
 			buffer = git__malloc(CACHED_POST_BODY_BUF_SIZE);
-			GIT_ERROR_CHECK_ALLOC(buffer);
 
 			while (len > 0) {
 				DWORD bytes_written;
@@ -1026,14 +985,14 @@ replay:
 					&bytes_read, NULL) ||
 					!bytes_read) {
 					git__free(buffer);
-					git_error_set(GIT_ERROR_OS, "failed to read from temp file");
+					giterr_set(GITERR_OS, "failed to read from temp file");
 					return -1;
 				}
 
 				if (!WinHttpWriteData(s->request, buffer,
 					bytes_read, &bytes_written)) {
 					git__free(buffer);
-					git_error_set(GIT_ERROR_OS, "failed to write data");
+					giterr_set(GITERR_OS, "failed to write data");
 					return -1;
 				}
 
@@ -1049,7 +1008,7 @@ replay:
 		}
 
 		if (!WinHttpReceiveResponse(s->request, 0)) {
-			git_error_set(GIT_ERROR_OS, "failed to receive response");
+			giterr_set(GITERR_OS, "failed to receive response");
 			return -1;
 		}
 
@@ -1061,7 +1020,7 @@ replay:
 			WINHTTP_HEADER_NAME_BY_INDEX,
 			&status_code, &status_code_length,
 			WINHTTP_NO_HEADER_INDEX)) {
-				git_error_set(GIT_ERROR_OS, "failed to retrieve status code");
+				giterr_set(GITERR_OS, "failed to retrieve status code");
 				return -1;
 		}
 
@@ -1075,8 +1034,7 @@ replay:
 			 HTTP_STATUS_REDIRECT == status_code ||
 			 (HTTP_STATUS_REDIRECT_METHOD == status_code &&
 			  get_verb == s->verb) ||
-			 HTTP_STATUS_REDIRECT_KEEP_VERB == status_code ||
-			 HTTP_STATUS_PERMANENT_REDIRECT == status_code)) {
+			 HTTP_STATUS_REDIRECT_KEEP_VERB == status_code)) {
 
 			/* Check for Windows 7. This workaround is only necessary on
 			 * Windows Vista and earlier. Windows 7 is version 6.1. */
@@ -1092,12 +1050,12 @@ replay:
 				&location_length,
 				WINHTTP_NO_HEADER_INDEX) ||
 				GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
-				git_error_set(GIT_ERROR_OS, "failed to read Location header");
+				giterr_set(GITERR_OS, "failed to read Location header");
 				return -1;
 			}
 
 			location = git__malloc(location_length);
-			GIT_ERROR_CHECK_ALLOC(location);
+			GITERR_CHECK_ALLOC(location);
 
 			if (!WinHttpQueryHeaders(s->request,
 				WINHTTP_QUERY_LOCATION,
@@ -1105,14 +1063,14 @@ replay:
 				location,
 				&location_length,
 				WINHTTP_NO_HEADER_INDEX)) {
-				git_error_set(GIT_ERROR_OS, "failed to read Location header");
+				giterr_set(GITERR_OS, "failed to read Location header");
 				git__free(location);
 				return -1;
 			}
 
 			/* Convert the Location header to UTF-8 */
 			if (git__utf16_to_8_alloc(&location8, location) < 0) {
-				git_error_set(GIT_ERROR_OS, "failed to convert Location header to UTF-8");
+				giterr_set(GITERR_OS, "failed to convert Location header to UTF-8");
 				git__free(location);
 				return -1;
 			}
@@ -1124,7 +1082,7 @@ replay:
 
 			if (!git__prefixcmp_icase(location8, prefix_https)) {
 				/* Upgrade to secure connection; disconnect and start over */
-				if (gitno_connection_data_handle_redirect(&t->server.url, location8, s->service_url) < 0) {
+				if (gitno_connection_data_from_url(&t->connection_data, location8, s->service_url) < 0) {
 					git__free(location8);
 					return -1;
 				}
@@ -1139,39 +1097,72 @@ replay:
 			goto replay;
 		}
 
-		/* Handle authentication failures */
-		if (status_code == HTTP_STATUS_DENIED) {
-			int error = acquire_credentials(s->request,
-				&t->server,
-				t->owner->url,
-				t->owner->cred_acquire_cb,
-				t->owner->cred_acquire_payload);
-
-			if (error < 0) {
-				return error;
-			} else if (!error) {
-				assert(t->server.cred);
-				winhttp_stream_close(s);
-				goto replay;
+		/* Handle proxy authentication failures */
+		if (status_code == HTTP_STATUS_PROXY_AUTH_REQ) {
+			int allowed_types;
+
+			if (parse_unauthorized_response(s->request, &allowed_types, &t->auth_mechanisms) < 0)
+				return -1;
+
+			/* TODO: extract the username from the url, no payload? */
+			if (t->owner->proxy.credentials) {
+				int cred_error = 1;
+				cred_error = t->owner->proxy.credentials(&t->proxy_cred, t->owner->proxy.url, NULL, allowed_types, t->owner->proxy.payload);
+
+				if (cred_error < 0)
+					return cred_error;
 			}
-		} else if (status_code == HTTP_STATUS_PROXY_AUTH_REQ) {
-			int error = acquire_credentials(s->request,
-				&t->proxy,
-				t->owner->proxy.url,
-				t->owner->proxy.credentials,
-				t->owner->proxy.payload);
-
-			if (error < 0) {
-				return error;
-			} else if (!error) {
-				assert(t->proxy.cred);
-				winhttp_stream_close(s);
-				goto replay;
+
+			winhttp_stream_close(s);
+			goto replay;
+		}
+
+		/* Handle authentication failures */
+		if (HTTP_STATUS_DENIED == status_code && get_verb == s->verb) {
+			int allowed_types;
+
+			if (parse_unauthorized_response(s->request, &allowed_types, &t->auth_mechanisms) < 0)
+				return -1;
+
+			if (allowed_types) {
+				int cred_error = 1;
+
+				git_cred_free(t->cred);
+				t->cred = NULL;
+				/* Start with the user-supplied credential callback, if present */
+				if (t->owner->cred_acquire_cb) {
+					cred_error = t->owner->cred_acquire_cb(&t->cred, t->owner->url,
+						t->connection_data.user, allowed_types,	t->owner->cred_acquire_payload);
+
+					/* Treat GIT_PASSTHROUGH as though git_cred_acquire_cb isn't set */
+					if (cred_error == GIT_PASSTHROUGH)
+						cred_error = 1;
+					else if (cred_error < 0)
+						return cred_error;
+				}
+
+				/* Invoke the fallback credentials acquisition callback if necessary */
+				if (cred_error > 0) {
+					cred_error = fallback_cred_acquire_cb(&t->cred, t->owner->url,
+						t->connection_data.user, allowed_types, NULL);
+
+					if (cred_error < 0)
+						return cred_error;
+				}
+
+				if (!cred_error) {
+					assert(t->cred);
+
+					winhttp_stream_close(s);
+
+					/* Successfully acquired a credential */
+					goto replay;
+				}
 			}
 		}
 
 		if (HTTP_STATUS_OK != status_code) {
-			git_error_set(GIT_ERROR_NET, "request failed with status code: %lu", status_code);
+			giterr_set(GITERR_NET, "request failed with status code: %d", status_code);
 			return -1;
 		}
 
@@ -1182,7 +1173,7 @@ replay:
 			p_snprintf(expected_content_type_8, MAX_CONTENT_TYPE_LEN, "application/x-git-%s-advertisement", s->service);
 
 		if (git__utf8_to_16(expected_content_type, MAX_CONTENT_TYPE_LEN, expected_content_type_8) < 0) {
-			git_error_set(GIT_ERROR_OS, "failed to convert expected content-type to wide characters");
+			giterr_set(GITERR_OS, "failed to convert expected content-type to wide characters");
 			return -1;
 		}
 
@@ -1193,12 +1184,12 @@ replay:
 			WINHTTP_HEADER_NAME_BY_INDEX,
 			&content_type, &content_type_length,
 			WINHTTP_NO_HEADER_INDEX)) {
-				git_error_set(GIT_ERROR_OS, "failed to retrieve response content-type");
+				giterr_set(GITERR_OS, "failed to retrieve response content-type");
 				return -1;
 		}
 
 		if (wcscmp(expected_content_type, content_type)) {
-			git_error_set(GIT_ERROR_NET, "received unexpected content-type");
+			giterr_set(GITERR_NET, "received unexpected content-type");
 			return -1;
 		}
 
@@ -1210,7 +1201,7 @@ replay:
 		(DWORD)buf_size,
 		&dw_bytes_read))
 	{
-		git_error_set(GIT_ERROR_OS, "failed to read data");
+		giterr_set(GITERR_OS, "failed to read data");
 		return -1;
 	}
 
@@ -1233,7 +1224,7 @@ static int winhttp_stream_write_single(
 
 	/* This implementation of write permits only a single call. */
 	if (s->sent_request) {
-		git_error_set(GIT_ERROR_NET, "subtransport configured for only one write");
+		giterr_set(GITERR_NET, "subtransport configured for only one write");
 		return -1;
 	}
 
@@ -1246,7 +1237,7 @@ static int winhttp_stream_write_single(
 			(LPCVOID)buffer,
 			(DWORD)len,
 			&bytes_written)) {
-		git_error_set(GIT_ERROR_OS, "failed to write data");
+		giterr_set(GITERR_OS, "failed to write data");
 		return -1;
 	}
 
@@ -1264,12 +1255,12 @@ static int put_uuid_string(LPWSTR buffer, size_t buffer_len_cch)
 	if (RPC_S_OK != status &&
 		RPC_S_UUID_LOCAL_ONLY != status &&
 		RPC_S_UUID_NO_ADDRESS != status) {
-		git_error_set(GIT_ERROR_NET, "unable to generate name for temp file");
+		giterr_set(GITERR_NET, "unable to generate name for temp file");
 		return -1;
 	}
 
 	if (buffer_len_cch < UUID_LENGTH_CCH + 1) {
-		git_error_set(GIT_ERROR_NET, "buffer too small for name of temp file");
+		giterr_set(GITERR_NET, "buffer too small for name of temp file");
 		return -1;
 	}
 
@@ -1284,7 +1275,7 @@ static int put_uuid_string(LPWSTR buffer, size_t buffer_len_cch)
 		uuid.Data4[4], uuid.Data4[5], uuid.Data4[6], uuid.Data4[7]);
 
 	if (result < UUID_LENGTH_CCH) {
-		git_error_set(GIT_ERROR_OS, "unable to generate name for temp file");
+		giterr_set(GITERR_OS, "unable to generate name for temp file");
 		return -1;
 	}
 
@@ -1296,7 +1287,7 @@ static int get_temp_file(LPWSTR buffer, DWORD buffer_len_cch)
 	size_t len;
 
 	if (!GetTempPathW(buffer_len_cch, buffer)) {
-		git_error_set(GIT_ERROR_OS, "failed to get temp path");
+		giterr_set(GITERR_OS, "failed to get temp path");
 		return -1;
 	}
 
@@ -1339,13 +1330,13 @@ static int winhttp_stream_write_buffered(
 
 		if (INVALID_HANDLE_VALUE == s->post_body) {
 			s->post_body = NULL;
-			git_error_set(GIT_ERROR_OS, "failed to create temporary file");
+			giterr_set(GITERR_OS, "failed to create temporary file");
 			return -1;
 		}
 	}
 
 	if (!WriteFile(s->post_body, buffer, (DWORD)len, &bytes_written, NULL)) {
-		git_error_set(GIT_ERROR_OS, "failed to write to temporary file");
+		giterr_set(GITERR_OS, "failed to write to temporary file");
 		return -1;
 	}
 
@@ -1372,7 +1363,7 @@ static int winhttp_stream_write_chunked(
 		if (!WinHttpAddRequestHeaders(s->request,
 			transfer_encoding, (ULONG) -1L,
 			WINHTTP_ADDREQ_FLAG_ADD)) {
-			git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
+			giterr_set(GITERR_OS, "failed to add a header to the request");
 			return -1;
 		}
 
@@ -1399,10 +1390,8 @@ static int winhttp_stream_write_chunked(
 		/* Append as much to the buffer as we can */
 		int count = (int)min(CACHED_POST_BODY_BUF_SIZE - s->chunk_buffer_len, len);
 
-		if (!s->chunk_buffer) {
+		if (!s->chunk_buffer)
 			s->chunk_buffer = git__malloc(CACHED_POST_BODY_BUF_SIZE);
-			GIT_ERROR_CHECK_ALLOC(s->chunk_buffer);
-		}
 
 		memcpy(s->chunk_buffer + s->chunk_buffer_len, buffer, count);
 		s->chunk_buffer_len += count;
@@ -1443,7 +1432,7 @@ static int winhttp_stream_alloc(winhttp_subtransport *t, winhttp_stream **stream
 		return -1;
 
 	s = git__calloc(1, sizeof(winhttp_stream));
-	GIT_ERROR_CHECK_ALLOC(s);
+	GITERR_CHECK_ALLOC(s);
 
 	s->parent.subtransport = &t->parent;
 	s->parent.read = winhttp_stream_read;
@@ -1527,7 +1516,7 @@ static int winhttp_action(
 	int ret = -1;
 
 	if (!t->connection)
-		if ((ret = git_net_url_parse(&t->server.url, url)) < 0 ||
+		if ((ret = gitno_connection_data_from_url(&t->connection_data, url, NULL)) < 0 ||
 			 (ret = winhttp_connect(t)) < 0)
 			return ret;
 
@@ -1569,17 +1558,24 @@ static int winhttp_close(git_smart_subtransport *subtransport)
 {
 	winhttp_subtransport *t = (winhttp_subtransport *)subtransport;
 
-	git_net_url_dispose(&t->server.url);
-	git_net_url_dispose(&t->proxy.url);
+	gitno_connection_data_free_ptrs(&t->connection_data);
+	memset(&t->connection_data, 0x0, sizeof(gitno_connection_data));
+	gitno_connection_data_free_ptrs(&t->proxy_connection_data);
+	memset(&t->proxy_connection_data, 0x0, sizeof(gitno_connection_data));
+
+	if (t->cred) {
+		t->cred->free(t->cred);
+		t->cred = NULL;
+	}
 
-	if (t->server.cred) {
-		t->server.cred->free(t->server.cred);
-		t->server.cred = NULL;
+	if (t->proxy_cred) {
+		t->proxy_cred->free(t->proxy_cred);
+		t->proxy_cred = NULL;
 	}
 
-	if (t->proxy.cred) {
-		t->proxy.cred->free(t->proxy.cred);
-		t->proxy.cred = NULL;
+	if (t->url_cred) {
+		t->url_cred->free(t->url_cred);
+		t->url_cred = NULL;
 	}
 
 	return winhttp_close_connection(t);
@@ -1604,7 +1600,7 @@ int git_smart_subtransport_http(git_smart_subtransport **out, git_transport *own
 		return -1;
 
 	t = git__calloc(1, sizeof(winhttp_subtransport));
-	GIT_ERROR_CHECK_ALLOC(t);
+	GITERR_CHECK_ALLOC(t);
 
 	t->owner = (transport_smart *)owner;
 	t->parent.action = winhttp_action;