src/transports/winhttp.c

   1 /*
   2  * Copyright (C) the libgit2 contributors. All rights reserved.
   3  *
   4  * This file is part of libgit2, distributed under the GNU GPL v2 with
   5  * a Linking Exception. For full terms see the included COPYING file.
   6  */
   7
   8 #include "common.h"
   9
  10 #ifdef GIT_WINHTTP
  11
  12 #include "git2.h"
  13 #include "git2/transport.h"
  14 #include "posix.h"
  15 #include "str.h"
  16 #include "netops.h"
  17 #include "smart.h"
  18 #include "remote.h"
  19 #include "repository.h"
  20 #include "http.h"
  21 #include "git2/sys/credential.h"
  22
  23 #include <wincrypt.h>
  24 #include <winhttp.h>
  25
  26 /* For IInternetSecurityManager zone check */
  27 #include <objbase.h>
  28 #include <urlmon.h>
  29
  30 #define WIDEN2(s) L ## s
  31 #define WIDEN(s) WIDEN2(s)
  32
  33 #define MAX_CONTENT_TYPE_LEN    100
  34 #define WINHTTP_OPTION_PEERDIST_EXTENSION_STATE 109
  35 #define CACHED_POST_BODY_BUF_SIZE       4096
  36 #define UUID_LENGTH_CCH 32
  37 #define TIMEOUT_INFINITE -1
  38 #define DEFAULT_CONNECT_TIMEOUT 60000
  39 #ifndef WINHTTP_IGNORE_REQUEST_TOTAL_LENGTH
  40 #define WINHTTP_IGNORE_REQUEST_TOTAL_LENGTH 0
  41 #endif
  42
  43 #ifndef WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1
  44 # define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 0x00000200
  45 #endif
  46
  47 #ifndef WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2
  48 # define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2 0x00000800
  49 #endif
  50
  51 #ifndef WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_3
  52 # define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_3 0x00002000
  53 #endif
  54
  55 #ifndef WINHTTP_NO_CLIENT_CERT_CONTEXT
  56 # define WINHTTP_NO_CLIENT_CERT_CONTEXT NULL
  57 #endif
  58
  59 #ifndef HTTP_STATUS_PERMANENT_REDIRECT
  60 # define HTTP_STATUS_PERMANENT_REDIRECT 308
  61 #endif
  62
  63 #ifndef DWORD_MAX
  64 # define DWORD_MAX 0xffffffff
  65 #endif
  66
  67 bool git_http__expect_continue = false;
  68
  69 static const char *prefix_https = "https://";
  70 static const char *upload_pack_service = "upload-pack";
  71 static const char *upload_pack_ls_service_url = "/info/refs?service=git-upload-pack";
  72 static const char *upload_pack_service_url = "/git-upload-pack";
  73 static const char *receive_pack_service = "receive-pack";
  74 static const char *receive_pack_ls_service_url = "/info/refs?service=git-receive-pack";
  75 static const char *receive_pack_service_url = "/git-receive-pack";
  76 static const wchar_t *get_verb = L"GET";
  77 static const wchar_t *post_verb = L"POST";
  78 static const wchar_t *pragma_nocache = L"Pragma: no-cache";
  79 static const wchar_t *transfer_encoding = L"Transfer-Encoding: chunked";
  80 static const int no_check_cert_flags = SECURITY_FLAG_IGNORE_CERT_CN_INVALID |
  81         SECURITY_FLAG_IGNORE_CERT_DATE_INVALID |
  82         SECURITY_FLAG_IGNORE_UNKNOWN_CA;
  83
  84 #if defined(__MINGW32__)
  85 static const CLSID CLSID_InternetSecurityManager_mingw =
  86         { 0x7B8A2D94, 0x0AC9, 0x11D1,
  87         { 0x89, 0x6C, 0x00, 0xC0, 0x4F, 0xB6, 0xBF, 0xC4 } };
  88 static const IID IID_IInternetSecurityManager_mingw =
  89         { 0x79EAC9EE, 0xBAF9, 0x11CE,
  90         { 0x8C, 0x82, 0x00, 0xAA, 0x00, 0x4B, 0xA9, 0x0B } };
  91
  92 # define CLSID_InternetSecurityManager CLSID_InternetSecurityManager_mingw
  93 # define IID_IInternetSecurityManager IID_IInternetSecurityManager_mingw
  94 #endif
  95
  96 #define OWNING_SUBTRANSPORT(s) ((winhttp_subtransport *)(s)->parent.subtransport)
  97
  98 typedef enum {
  99         GIT_WINHTTP_AUTH_BASIC = 1,
 100         GIT_WINHTTP_AUTH_NTLM = 2,
 101         GIT_WINHTTP_AUTH_NEGOTIATE = 4,
 102         GIT_WINHTTP_AUTH_DIGEST = 8
 103 } winhttp_authmechanism_t;
 104
 105 typedef struct {
 106         git_smart_subtransport_stream parent;
 107         const char *service;
 108         const char *service_url;
 109         const wchar_t *verb;
 110         HINTERNET request;
 111         wchar_t *request_uri;
 112         char *chunk_buffer;
 113         unsigned chunk_buffer_len;
 114         HANDLE post_body;
 115         DWORD post_body_len;
 116         unsigned sent_request : 1,
 117                 received_response : 1,
 118                 chunked : 1,
 119                 status_sending_request_reached: 1;
 120 } winhttp_stream;
 121
 122 typedef struct {
 123         git_net_url url;
 124         git_credential *cred;
 125         int auth_mechanisms;
 126         bool url_cred_presented;
 127 } winhttp_server;
 128
 129 typedef struct {
 130         git_smart_subtransport parent;
 131         transport_smart *owner;
 132
 133         winhttp_server server;
 134         winhttp_server proxy;
 135
 136         HINTERNET session;
 137         HINTERNET connection;
 138 } winhttp_subtransport;
 139
 140 static int apply_userpass_credentials(HINTERNET request, DWORD target, int mechanisms, git_credential *cred)
 141 {
 142         git_credential_userpass_plaintext *c = (git_credential_userpass_plaintext *)cred;
 143         wchar_t *user = NULL, *pass = NULL;
 144         int user_len = 0, pass_len = 0, error = 0;
 145         DWORD native_scheme;
 146
 147         if (mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) {
 148                 native_scheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
 149         } else if (mechanisms & GIT_WINHTTP_AUTH_NTLM) {
 150                 native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
 151         } else if (mechanisms & GIT_WINHTTP_AUTH_DIGEST) {
 152                 native_scheme = WINHTTP_AUTH_SCHEME_DIGEST;
 153         } else if (mechanisms & GIT_WINHTTP_AUTH_BASIC) {
 154                 native_scheme = WINHTTP_AUTH_SCHEME_BASIC;
 155         } else {
 156                 git_error_set(GIT_ERROR_HTTP, "invalid authentication scheme");
 157                 error = GIT_EAUTH;
 158                 goto done;
 159         }
 160
 161         if ((error = user_len = git__utf8_to_16_alloc(&user, c->username)) < 0)
 162                 goto done;
 163
 164         if ((error = pass_len = git__utf8_to_16_alloc(&pass, c->password)) < 0)
 165                 goto done;
 166
 167         if (!WinHttpSetCredentials(request, target, native_scheme, user, pass, NULL)) {
 168                 git_error_set(GIT_ERROR_OS, "failed to set credentials");
 169                 error = -1;
 170         }
 171
 172 done:
 173         if (user_len > 0)
 174                 git__memzero(user, user_len * sizeof(wchar_t));
 175
 176         if (pass_len > 0)
 177                 git__memzero(pass, pass_len * sizeof(wchar_t));
 178
 179         git__free(user);
 180         git__free(pass);
 181
 182         return error;
 183 }
 184
 185 static int apply_default_credentials(HINTERNET request, DWORD target, int mechanisms)
 186 {
 187         DWORD autologon_level = WINHTTP_AUTOLOGON_SECURITY_LEVEL_LOW;
 188         DWORD native_scheme = 0;
 189
 190         if ((mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) != 0) {
 191                 native_scheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
 192         } else if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) != 0) {
 193                 native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
 194         } else {
 195                 git_error_set(GIT_ERROR_HTTP, "invalid authentication scheme");
 196                 return GIT_EAUTH;
 197         }
 198
 199         /*
 200          * Autologon policy must be "low" to use default creds.
 201          * This is safe as the user has explicitly requested it.
 202          */
 203         if (!WinHttpSetOption(request, WINHTTP_OPTION_AUTOLOGON_POLICY, &autologon_level, sizeof(DWORD))) {
 204                 git_error_set(GIT_ERROR_OS, "could not configure logon policy");
 205                 return -1;
 206         }
 207
 208         if (!WinHttpSetCredentials(request, target, native_scheme, NULL, NULL, NULL)) {
 209                 git_error_set(GIT_ERROR_OS, "could not configure credentials");
 210                 return -1;
 211         }
 212
 213         return 0;
 214 }
 215
 216 static int acquire_url_cred(
 217         git_credential **cred,
 218         unsigned int allowed_types,
 219         const char *username,
 220         const char *password)
 221 {
 222         if (allowed_types & GIT_CREDENTIAL_USERPASS_PLAINTEXT)
 223                 return git_credential_userpass_plaintext_new(cred, username, password);
 224
 225         if ((allowed_types & GIT_CREDENTIAL_DEFAULT) && *username == '\0' && *password == '\0')
 226                 return git_credential_default_new(cred);
 227
 228         return 1;
 229 }
 230
 231 static int acquire_fallback_cred(
 232         git_credential **cred,
 233         const char *url,
 234         unsigned int allowed_types)
 235 {
 236         int error = 1;
 237
 238         /* If the target URI supports integrated Windows authentication
 239          * as an authentication mechanism */
 240         if (GIT_CREDENTIAL_DEFAULT & allowed_types) {
 241                 wchar_t *wide_url;
 242                 HRESULT hCoInitResult;
 243
 244                 /* Convert URL to wide characters */
 245                 if (git__utf8_to_16_alloc(&wide_url, url) < 0) {
 246                         git_error_set(GIT_ERROR_OS, "failed to convert string to wide form");
 247                         return -1;
 248                 }
 249
 250                 hCoInitResult = CoInitializeEx(NULL, COINIT_MULTITHREADED);
 251
 252                 if (SUCCEEDED(hCoInitResult) || hCoInitResult == RPC_E_CHANGED_MODE) {
 253                         IInternetSecurityManager *pISM;
 254
 255                         /* And if the target URI is in the My Computer, Intranet, or Trusted zones */
 256                         if (SUCCEEDED(CoCreateInstance(&CLSID_InternetSecurityManager, NULL,
 257                                 CLSCTX_ALL, &IID_IInternetSecurityManager, (void **)&pISM))) {
 258                                 DWORD dwZone;
 259
 260                                 if (SUCCEEDED(pISM->lpVtbl->MapUrlToZone(pISM, wide_url, &dwZone, 0)) &&
 261                                         (URLZONE_LOCAL_MACHINE == dwZone ||
 262                                         URLZONE_INTRANET == dwZone ||
 263                                         URLZONE_TRUSTED == dwZone)) {
 264                                         git_credential *existing = *cred;
 265
 266                                         if (existing)
 267                                                 existing->free(existing);
 268
 269                                         /* Then use default Windows credentials to authenticate this request */
 270                                         error = git_credential_default_new(cred);
 271                                 }
 272
 273                                 pISM->lpVtbl->Release(pISM);
 274                         }
 275
 276                         /* Only uninitialize if the call to CoInitializeEx was successful. */
 277                         if (SUCCEEDED(hCoInitResult))
 278                                 CoUninitialize();
 279                 }
 280
 281                 git__free(wide_url);
 282         }
 283
 284         return error;
 285 }
 286
 287 static int certificate_check(winhttp_stream *s, int valid)
 288 {
 289         int error;
 290         winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
 291         PCERT_CONTEXT cert_ctx;
 292         DWORD cert_ctx_size = sizeof(cert_ctx);
 293         git_cert_x509 cert;
 294
 295         /* If there is no override, we should fail if WinHTTP doesn't think it's fine */
 296         if (t->owner->connect_opts.callbacks.certificate_check == NULL && !valid) {
 297                 if (!git_error_last())
 298                         git_error_set(GIT_ERROR_HTTP, "unknown certificate check failure");
 299
 300                 return GIT_ECERTIFICATE;
 301         }
 302
 303         if (t->owner->connect_opts.callbacks.certificate_check == NULL || git__strcmp(t->server.url.scheme, "https") != 0)
 304                 return 0;
 305
 306         if (!WinHttpQueryOption(s->request, WINHTTP_OPTION_SERVER_CERT_CONTEXT, &cert_ctx, &cert_ctx_size)) {
 307                 git_error_set(GIT_ERROR_OS, "failed to get server certificate");
 308                 return -1;
 309         }
 310
 311         git_error_clear();
 312         cert.parent.cert_type = GIT_CERT_X509;
 313         cert.data = cert_ctx->pbCertEncoded;
 314         cert.len = cert_ctx->cbCertEncoded;
 315         error = t->owner->connect_opts.callbacks.certificate_check((git_cert *) &cert, valid, t->server.url.host, t->owner->connect_opts.callbacks.payload);
 316         CertFreeCertificateContext(cert_ctx);
 317
 318         if (error == GIT_PASSTHROUGH)
 319                 error = valid ? 0 : GIT_ECERTIFICATE;
 320
 321         if (error < 0 && !git_error_last())
 322                 git_error_set(GIT_ERROR_HTTP, "user cancelled certificate check");
 323
 324         return error;
 325 }
 326
 327 static void winhttp_stream_close(winhttp_stream *s)
 328 {
 329         if (s->chunk_buffer) {
 330                 git__free(s->chunk_buffer);
 331                 s->chunk_buffer = NULL;
 332         }
 333
 334         if (s->post_body) {
 335                 CloseHandle(s->post_body);
 336                 s->post_body = NULL;
 337         }
 338
 339         if (s->request_uri) {
 340                 git__free(s->request_uri);
 341                 s->request_uri = NULL;
 342         }
 343
 344         if (s->request) {
 345                 WinHttpCloseHandle(s->request);
 346                 s->request = NULL;
 347         }
 348
 349         s->sent_request = 0;
 350 }
 351
 352 static int apply_credentials(
 353         HINTERNET request,
 354         git_net_url *url,
 355         int target,
 356         git_credential *creds,
 357         int mechanisms)
 358 {
 359         int error = 0;
 360
 361         GIT_UNUSED(url);
 362
 363         /* If we have creds, just apply them */
 364         if (creds && creds->credtype == GIT_CREDENTIAL_USERPASS_PLAINTEXT)
 365                 error = apply_userpass_credentials(request, target, mechanisms, creds);
 366         else if (creds && creds->credtype == GIT_CREDENTIAL_DEFAULT)
 367                 error = apply_default_credentials(request, target, mechanisms);
 368
 369         return error;
 370 }
 371
 372 static int winhttp_stream_connect(winhttp_stream *s)
 373 {
 374         winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
 375         git_str buf = GIT_STR_INIT;
 376         char *proxy_url = NULL;
 377         wchar_t ct[MAX_CONTENT_TYPE_LEN];
 378         LPCWSTR types[] = { L"*/*", NULL };
 379         BOOL peerdist = FALSE;
 380         int error = -1;
 381         unsigned long disable_redirects = WINHTTP_DISABLE_REDIRECTS;
 382         int default_timeout = TIMEOUT_INFINITE;
 383         int default_connect_timeout = DEFAULT_CONNECT_TIMEOUT;
 384         DWORD autologon_policy = WINHTTP_AUTOLOGON_SECURITY_LEVEL_HIGH;
 385
 386         const char *service_url = s->service_url;
 387         size_t i;
 388         const git_proxy_options *proxy_opts;
 389
 390         /* If path already ends in /, remove the leading slash from service_url */
 391         if ((git__suffixcmp(t->server.url.path, "/") == 0) && (git__prefixcmp(service_url, "/") == 0))
 392                 service_url++;
 393         /* Prepare URL */
 394         git_str_printf(&buf, "%s%s", t->server.url.path, service_url);
 395
 396         if (git_str_oom(&buf))
 397                 return -1;
 398
 399         /* Convert URL to wide characters */
 400         if (git__utf8_to_16_alloc(&s->request_uri, git_str_cstr(&buf)) < 0) {
 401                 git_error_set(GIT_ERROR_OS, "failed to convert string to wide form");
 402                 goto on_error;
 403         }
 404
 405         /* Establish request */
 406         s->request = WinHttpOpenRequest(
 407                         t->connection,
 408                         s->verb,
 409                         s->request_uri,
 410                         NULL,
 411                         WINHTTP_NO_REFERER,
 412                         types,
 413                         git__strcmp(t->server.url.scheme, "https") == 0 ? WINHTTP_FLAG_SECURE : 0);
 414
 415         if (!s->request) {
 416                 git_error_set(GIT_ERROR_OS, "failed to open request");
 417                 goto on_error;
 418         }
 419
 420         /* Never attempt default credentials; we'll provide them explicitly. */
 421         if (!WinHttpSetOption(s->request, WINHTTP_OPTION_AUTOLOGON_POLICY, &autologon_policy, sizeof(DWORD)))
 422                 return -1;
 423
 424         if (!WinHttpSetTimeouts(s->request, default_timeout, default_connect_timeout, default_timeout, default_timeout)) {
 425                 git_error_set(GIT_ERROR_OS, "failed to set timeouts for WinHTTP");
 426                 goto on_error;
 427         }
 428
 429         proxy_opts = &t->owner->connect_opts.proxy_opts;
 430         if (proxy_opts->type == GIT_PROXY_AUTO) {
 431                 /* Set proxy if necessary */
 432                 if (git_remote__http_proxy(&proxy_url, t->owner->owner, &t->server.url) < 0)
 433                         goto on_error;
 434         }
 435         else if (proxy_opts->type == GIT_PROXY_SPECIFIED) {
 436                 proxy_url = git__strdup(proxy_opts->url);
 437                 GIT_ERROR_CHECK_ALLOC(proxy_url);
 438         }
 439
 440         if (proxy_url) {
 441                 git_str processed_url = GIT_STR_INIT;
 442                 WINHTTP_PROXY_INFO proxy_info;
 443                 wchar_t *proxy_wide;
 444
 445                 git_net_url_dispose(&t->proxy.url);
 446
 447                 if ((error = git_net_url_parse(&t->proxy.url, proxy_url)) < 0)
 448                         goto on_error;
 449
 450                 if (strcmp(t->proxy.url.scheme, "http") != 0 && strcmp(t->proxy.url.scheme, "https") != 0) {
 451                         git_error_set(GIT_ERROR_HTTP, "invalid URL: '%s'", proxy_url);
 452                         error = -1;
 453                         goto on_error;
 454                 }
 455
 456                 git_str_puts(&processed_url, t->proxy.url.scheme);
 457                 git_str_PUTS(&processed_url, "://");
 458
 459                 if (git_net_url_is_ipv6(&t->proxy.url))
 460                         git_str_putc(&processed_url, '[');
 461
 462                 git_str_puts(&processed_url, t->proxy.url.host);
 463
 464                 if (git_net_url_is_ipv6(&t->proxy.url))
 465                         git_str_putc(&processed_url, ']');
 466
 467                 if (!git_net_url_is_default_port(&t->proxy.url))
 468                         git_str_printf(&processed_url, ":%s", t->proxy.url.port);
 469
 470                 if (git_str_oom(&processed_url)) {
 471                         error = -1;
 472                         goto on_error;
 473                 }
 474
 475                 /* Convert URL to wide characters */
 476                 error = git__utf8_to_16_alloc(&proxy_wide, processed_url.ptr);
 477                 git_str_dispose(&processed_url);
 478                 if (error < 0)
 479                         goto on_error;
 480
 481                 proxy_info.dwAccessType = WINHTTP_ACCESS_TYPE_NAMED_PROXY;
 482                 proxy_info.lpszProxy = proxy_wide;
 483                 proxy_info.lpszProxyBypass = NULL;
 484
 485                 if (!WinHttpSetOption(s->request,
 486                         WINHTTP_OPTION_PROXY,
 487                         &proxy_info,
 488                         sizeof(WINHTTP_PROXY_INFO))) {
 489                         git_error_set(GIT_ERROR_OS, "failed to set proxy");
 490                         git__free(proxy_wide);
 491                         goto on_error;
 492                 }
 493
 494                 git__free(proxy_wide);
 495
 496                 if ((error = apply_credentials(s->request, &t->proxy.url, WINHTTP_AUTH_TARGET_PROXY, t->proxy.cred, t->proxy.auth_mechanisms)) < 0)
 497                         goto on_error;
 498         }
 499
 500         /* Disable WinHTTP redirects so we can handle them manually. Why, you ask?
 501          * http://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/b2ff8879-ab9f-4218-8f09-16d25dff87ae
 502          */
 503         if (!WinHttpSetOption(s->request,
 504                 WINHTTP_OPTION_DISABLE_FEATURE,
 505                 &disable_redirects,
 506                 sizeof(disable_redirects))) {
 507                         git_error_set(GIT_ERROR_OS, "failed to disable redirects");
 508                         error = -1;
 509                         goto on_error;
 510         }
 511
 512         /* Strip unwanted headers (X-P2P-PeerDist, X-P2P-PeerDistEx) that WinHTTP
 513          * adds itself. This option may not be supported by the underlying
 514          * platform, so we do not error-check it */
 515         WinHttpSetOption(s->request,
 516                 WINHTTP_OPTION_PEERDIST_EXTENSION_STATE,
 517                 &peerdist,
 518                 sizeof(peerdist));
 519
 520         /* Send Pragma: no-cache header */
 521         if (!WinHttpAddRequestHeaders(s->request, pragma_nocache, (ULONG) -1L, WINHTTP_ADDREQ_FLAG_ADD)) {
 522                 git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
 523                 goto on_error;
 524         }
 525
 526         if (post_verb == s->verb) {
 527                 /* Send Content-Type and Accept headers -- only necessary on a POST */
 528                 git_str_clear(&buf);
 529                 if (git_str_printf(&buf,
 530                         "Content-Type: application/x-git-%s-request",
 531                         s->service) < 0)
 532                         goto on_error;
 533
 534                 if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_str_cstr(&buf)) < 0) {
 535                         git_error_set(GIT_ERROR_OS, "failed to convert content-type to wide characters");
 536                         goto on_error;
 537                 }
 538
 539                 if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
 540                         WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
 541                         git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
 542                         goto on_error;
 543                 }
 544
 545                 git_str_clear(&buf);
 546                 if (git_str_printf(&buf,
 547                         "Accept: application/x-git-%s-result",
 548                         s->service) < 0)
 549                         goto on_error;
 550
 551                 if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_str_cstr(&buf)) < 0) {
 552                         git_error_set(GIT_ERROR_OS, "failed to convert accept header to wide characters");
 553                         goto on_error;
 554                 }
 555
 556                 if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
 557                         WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
 558                         git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
 559                         goto on_error;
 560                 }
 561         }
 562
 563         for (i = 0; i < t->owner->connect_opts.custom_headers.count; i++) {
 564                 if (t->owner->connect_opts.custom_headers.strings[i]) {
 565                         git_str_clear(&buf);
 566                         git_str_puts(&buf, t->owner->connect_opts.custom_headers.strings[i]);
 567                         if (git__utf8_to_16(ct, MAX_CONTENT_TYPE_LEN, git_str_cstr(&buf)) < 0) {
 568                                 git_error_set(GIT_ERROR_OS, "failed to convert custom header to wide characters");
 569                                 goto on_error;
 570                         }
 571
 572                         if (!WinHttpAddRequestHeaders(s->request, ct, (ULONG)-1L,
 573                                 WINHTTP_ADDREQ_FLAG_ADD | WINHTTP_ADDREQ_FLAG_REPLACE)) {
 574                                 git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
 575                                 goto on_error;
 576                         }
 577                 }
 578         }
 579
 580         if ((error = apply_credentials(s->request, &t->server.url, WINHTTP_AUTH_TARGET_SERVER, t->server.cred, t->server.auth_mechanisms)) < 0)
 581                 goto on_error;
 582
 583         /* We've done everything up to calling WinHttpSendRequest. */
 584
 585         error = 0;
 586
 587 on_error:
 588         if (error < 0)
 589                 winhttp_stream_close(s);
 590
 591         git__free(proxy_url);
 592         git_str_dispose(&buf);
 593         return error;
 594 }
 595
 596 static int parse_unauthorized_response(
 597         int *allowed_types,
 598         int *allowed_mechanisms,
 599         HINTERNET request)
 600 {
 601         DWORD supported, first, target;
 602
 603         *allowed_types = 0;
 604         *allowed_mechanisms = 0;
 605
 606         /* WinHttpQueryHeaders() must be called before WinHttpQueryAuthSchemes().
 607          * We can assume this was already done, since we know we are unauthorized.
 608          */
 609         if (!WinHttpQueryAuthSchemes(request, &supported, &first, &target)) {
 610                 git_error_set(GIT_ERROR_OS, "failed to parse supported auth schemes");
 611                 return GIT_EAUTH;
 612         }
 613
 614         if (WINHTTP_AUTH_SCHEME_NTLM & supported) {
 615                 *allowed_types |= GIT_CREDENTIAL_USERPASS_PLAINTEXT;
 616                 *allowed_types |= GIT_CREDENTIAL_DEFAULT;
 617                 *allowed_mechanisms |= GIT_WINHTTP_AUTH_NTLM;
 618         }
 619
 620         if (WINHTTP_AUTH_SCHEME_NEGOTIATE & supported) {
 621                 *allowed_types |= GIT_CREDENTIAL_DEFAULT;
 622                 *allowed_mechanisms |= GIT_WINHTTP_AUTH_NEGOTIATE;
 623         }
 624
 625         if (WINHTTP_AUTH_SCHEME_BASIC & supported) {
 626                 *allowed_types |= GIT_CREDENTIAL_USERPASS_PLAINTEXT;
 627                 *allowed_mechanisms |= GIT_WINHTTP_AUTH_BASIC;
 628         }
 629
 630         if (WINHTTP_AUTH_SCHEME_DIGEST & supported) {
 631                 *allowed_types |= GIT_CREDENTIAL_USERPASS_PLAINTEXT;
 632                 *allowed_mechanisms |= GIT_WINHTTP_AUTH_DIGEST;
 633         }
 634
 635         return 0;
 636 }
 637
 638 static int write_chunk(HINTERNET request, const char *buffer, size_t len)
 639 {
 640         DWORD bytes_written;
 641         git_str buf = GIT_STR_INIT;
 642
 643         /* Chunk header */
 644         git_str_printf(&buf, "%"PRIXZ"\r\n", len);
 645
 646         if (git_str_oom(&buf))
 647                 return -1;
 648
 649         if (!WinHttpWriteData(request,
 650                 git_str_cstr(&buf),     (DWORD)git_str_len(&buf),
 651                 &bytes_written)) {
 652                 git_str_dispose(&buf);
 653                 git_error_set(GIT_ERROR_OS, "failed to write chunk header");
 654                 return -1;
 655         }
 656
 657         git_str_dispose(&buf);
 658
 659         /* Chunk body */
 660         if (!WinHttpWriteData(request,
 661                 buffer, (DWORD)len,
 662                 &bytes_written)) {
 663                 git_error_set(GIT_ERROR_OS, "failed to write chunk");
 664                 return -1;
 665         }
 666
 667         /* Chunk footer */
 668         if (!WinHttpWriteData(request,
 669                 "\r\n", 2,
 670                 &bytes_written)) {
 671                 git_error_set(GIT_ERROR_OS, "failed to write chunk footer");
 672                 return -1;
 673         }
 674
 675         return 0;
 676 }
 677
 678 static int winhttp_close_connection(winhttp_subtransport *t)
 679 {
 680         int ret = 0;
 681
 682         if (t->connection) {
 683                 if (!WinHttpCloseHandle(t->connection)) {
 684                         git_error_set(GIT_ERROR_OS, "unable to close connection");
 685                         ret = -1;
 686                 }
 687
 688                 t->connection = NULL;
 689         }
 690
 691         if (t->session) {
 692                 if (!WinHttpCloseHandle(t->session)) {
 693                         git_error_set(GIT_ERROR_OS, "unable to close session");
 694                         ret = -1;
 695                 }
 696
 697                 t->session = NULL;
 698         }
 699
 700         return ret;
 701 }
 702
 703 static void CALLBACK winhttp_status(
 704         HINTERNET connection,
 705         DWORD_PTR ctx,
 706         DWORD code,
 707         LPVOID info,
 708         DWORD info_len)
 709 {
 710         DWORD status;
 711
 712         GIT_UNUSED(connection);
 713         GIT_UNUSED(info_len);
 714
 715         switch (code) {
 716                 case WINHTTP_CALLBACK_STATUS_SECURE_FAILURE:
 717                         status = *((DWORD *)info);
 718
 719                         if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_CN_INVALID))
 720                                 git_error_set(GIT_ERROR_HTTP, "SSL certificate issued for different common name");
 721                         else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_DATE_INVALID))
 722                                 git_error_set(GIT_ERROR_HTTP, "SSL certificate has expired");
 723                         else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA))
 724                                 git_error_set(GIT_ERROR_HTTP, "SSL certificate signed by unknown CA");
 725                         else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CERT))
 726                                 git_error_set(GIT_ERROR_HTTP, "SSL certificate is invalid");
 727                         else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED))
 728                                 git_error_set(GIT_ERROR_HTTP, "certificate revocation check failed");
 729                         else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_CERT_REVOKED))
 730                                 git_error_set(GIT_ERROR_HTTP, "SSL certificate was revoked");
 731                         else if ((status & WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR))
 732                                 git_error_set(GIT_ERROR_HTTP, "security libraries could not be loaded");
 733                         else
 734                                 git_error_set(GIT_ERROR_HTTP, "unknown security error %lu", status);
 735
 736                         break;
 737
 738                 case WINHTTP_CALLBACK_STATUS_SENDING_REQUEST:
 739                         ((winhttp_stream *) ctx)->status_sending_request_reached = 1;
 740
 741                         break;
 742         }
 743 }
 744
 745 static int winhttp_connect(
 746         winhttp_subtransport *t)
 747 {
 748         wchar_t *wide_host = NULL;
 749         int32_t port;
 750         wchar_t *wide_ua = NULL;
 751         git_str ipv6 = GIT_STR_INIT, ua = GIT_STR_INIT;
 752         const char *host;
 753         int error = -1;
 754         int default_timeout = TIMEOUT_INFINITE;
 755         int default_connect_timeout = DEFAULT_CONNECT_TIMEOUT;
 756         DWORD protocols =
 757                 WINHTTP_FLAG_SECURE_PROTOCOL_TLS1 |
 758                 WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 |
 759                 WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2 |
 760                 WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_3;
 761
 762         t->session = NULL;
 763         t->connection = NULL;
 764
 765         /* Prepare port */
 766         if (git__strntol32(&port, t->server.url.port,
 767                            strlen(t->server.url.port), NULL, 10) < 0)
 768                 goto on_error;
 769
 770         /* IPv6? Add braces around the host. */
 771         if (git_net_url_is_ipv6(&t->server.url)) {
 772                 if (git_str_printf(&ipv6, "[%s]", t->server.url.host) < 0)
 773                         goto on_error;
 774
 775                 host = ipv6.ptr;
 776         } else {
 777                 host = t->server.url.host;
 778         }
 779
 780         /* Prepare host */
 781         if (git__utf8_to_16_alloc(&wide_host, host) < 0) {
 782                 git_error_set(GIT_ERROR_OS, "unable to convert host to wide characters");
 783                 goto on_error;
 784         }
 785
 786
 787         if (git_http__user_agent(&ua) < 0)
 788                 goto on_error;
 789
 790         if (git__utf8_to_16_alloc(&wide_ua, git_str_cstr(&ua)) < 0) {
 791                 git_error_set(GIT_ERROR_OS, "unable to convert host to wide characters");
 792                 goto on_error;
 793         }
 794
 795         /* Establish session */
 796         t->session = WinHttpOpen(
 797                 wide_ua,
 798                 WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
 799                 WINHTTP_NO_PROXY_NAME,
 800                 WINHTTP_NO_PROXY_BYPASS,
 801                 0);
 802
 803         if (!t->session) {
 804                 git_error_set(GIT_ERROR_OS, "failed to init WinHTTP");
 805                 goto on_error;
 806         }
 807
 808         /*
 809          * Do a best-effort attempt to enable TLS 1.3 and 1.2 but allow this to
 810          * fail; if TLS 1.2 or 1.3 support is not available for some reason,
 811          * ignore the failure (it will keep the default protocols).
 812          */
 813         if (WinHttpSetOption(t->session,
 814                 WINHTTP_OPTION_SECURE_PROTOCOLS,
 815                 &protocols,
 816                 sizeof(protocols)) == FALSE) {
 817                 protocols &= ~WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_3;
 818                 WinHttpSetOption(t->session,
 819                         WINHTTP_OPTION_SECURE_PROTOCOLS,
 820                         &protocols,
 821                         sizeof(protocols));
 822         }
 823
 824         if (!WinHttpSetTimeouts(t->session, default_timeout, default_connect_timeout, default_timeout, default_timeout)) {
 825                 git_error_set(GIT_ERROR_OS, "failed to set timeouts for WinHTTP");
 826                 goto on_error;
 827         }
 828
 829
 830         /* Establish connection */
 831         t->connection = WinHttpConnect(
 832                 t->session,
 833                 wide_host,
 834                 (INTERNET_PORT) port,
 835                 0);
 836
 837         if (!t->connection) {
 838                 git_error_set(GIT_ERROR_OS, "failed to connect to host");
 839                 goto on_error;
 840         }
 841
 842         if (WinHttpSetStatusCallback(
 843                         t->connection,
 844                         winhttp_status,
 845                         WINHTTP_CALLBACK_FLAG_SECURE_FAILURE | WINHTTP_CALLBACK_FLAG_SEND_REQUEST,
 846                         0
 847                 ) == WINHTTP_INVALID_STATUS_CALLBACK) {
 848                 git_error_set(GIT_ERROR_OS, "failed to set status callback");
 849                 goto on_error;
 850         }
 851
 852         error = 0;
 853
 854 on_error:
 855         if (error < 0)
 856                 winhttp_close_connection(t);
 857
 858         git_str_dispose(&ua);
 859         git_str_dispose(&ipv6);
 860         git__free(wide_host);
 861         git__free(wide_ua);
 862
 863         return error;
 864 }
 865
 866 static int do_send_request(winhttp_stream *s, size_t len, bool chunked)
 867 {
 868         int attempts;
 869         bool success;
 870
 871         if (len > DWORD_MAX) {
 872                 SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 873                 return -1;
 874         }
 875
 876         for (attempts = 0; attempts < 5; attempts++) {
 877                 if (chunked) {
 878                         success = WinHttpSendRequest(s->request,
 879                                 WINHTTP_NO_ADDITIONAL_HEADERS, 0,
 880                                 WINHTTP_NO_REQUEST_DATA, 0,
 881                                 WINHTTP_IGNORE_REQUEST_TOTAL_LENGTH, (DWORD_PTR)s);
 882                 } else {
 883                         success = WinHttpSendRequest(s->request,
 884                                 WINHTTP_NO_ADDITIONAL_HEADERS, 0,
 885                                 WINHTTP_NO_REQUEST_DATA, 0,
 886                                 (DWORD)len, (DWORD_PTR)s);
 887                 }
 888
 889                 if (success || GetLastError() != (DWORD)SEC_E_BUFFER_TOO_SMALL)
 890                         break;
 891         }
 892
 893         return success ? 0 : -1;
 894 }
 895
 896 static int send_request(winhttp_stream *s, size_t len, bool chunked)
 897 {
 898         int request_failed = 1, error, attempts = 0;
 899         DWORD ignore_flags, send_request_error;
 900
 901         git_error_clear();
 902
 903         while (request_failed && attempts++ < 3) {
 904                 int cert_valid = 1;
 905                 int client_cert_requested = 0;
 906                 request_failed = 0;
 907                 if ((error = do_send_request(s, len, chunked)) < 0) {
 908                         send_request_error = GetLastError();
 909                         request_failed = 1;
 910                         switch (send_request_error) {
 911                                 case ERROR_WINHTTP_SECURE_FAILURE:
 912                                         cert_valid = 0;
 913                                         break;
 914                                 case ERROR_WINHTTP_CLIENT_AUTH_CERT_NEEDED:
 915                                         client_cert_requested = 1;
 916                                         break;
 917                                 default:
 918                                         git_error_set(GIT_ERROR_OS, "failed to send request");
 919                                         return -1;
 920                         }
 921                 }
 922
 923                 /*
 924                  * Only check the certificate if we were able to reach the sending request phase, or
 925                  * received a secure failure error. Otherwise, the server certificate won't be available
 926                  * since the request wasn't able to complete (e.g. proxy auth required)
 927                  */
 928                 if (!cert_valid ||
 929                         (!request_failed && s->status_sending_request_reached)) {
 930                         git_error_clear();
 931                         if ((error = certificate_check(s, cert_valid)) < 0) {
 932                                 if (!git_error_last())
 933                                         git_error_set(GIT_ERROR_OS, "user cancelled certificate check");
 934
 935                                 return error;
 936                         }
 937                 }
 938
 939                 /* if neither the request nor the certificate check returned errors, we're done */
 940                 if (!request_failed)
 941                         return 0;
 942
 943                 if (!cert_valid) {
 944                         ignore_flags = no_check_cert_flags;
 945                         if (!WinHttpSetOption(s->request, WINHTTP_OPTION_SECURITY_FLAGS, &ignore_flags, sizeof(ignore_flags))) {
 946                                 git_error_set(GIT_ERROR_OS, "failed to set security options");
 947                                 return -1;
 948                         }
 949                 }
 950
 951                 if (client_cert_requested) {
 952                         /*
 953                          * Client certificates are not supported, explicitly tell the server that
 954                          * (it's possible a client certificate was requested but is not required)
 955                          */
 956                         if (!WinHttpSetOption(s->request, WINHTTP_OPTION_CLIENT_CERT_CONTEXT, WINHTTP_NO_CLIENT_CERT_CONTEXT, 0)) {
 957                                 git_error_set(GIT_ERROR_OS, "failed to set client cert context");
 958                                 return -1;
 959                         }
 960                 }
 961         }
 962
 963         return error;
 964 }
 965
 966 static int acquire_credentials(
 967         HINTERNET request,
 968         winhttp_server *server,
 969         const char *url_str,
 970         git_credential_acquire_cb cred_cb,
 971         void *cred_cb_payload)
 972 {
 973         int allowed_types;
 974         int error = 1;
 975
 976         if (parse_unauthorized_response(&allowed_types, &server->auth_mechanisms, request) < 0)
 977                 return -1;
 978
 979         if (allowed_types) {
 980                 git_credential_free(server->cred);
 981                 server->cred = NULL;
 982
 983                 /* Start with URL-specified credentials, if there were any. */
 984                 if (!server->url_cred_presented && server->url.username && server->url.password) {
 985                         error = acquire_url_cred(&server->cred, allowed_types, server->url.username, server->url.password);
 986                         server->url_cred_presented = 1;
 987
 988                         if (error < 0)
 989                                 return error;
 990                 }
 991
 992                 /* Next use the user-defined callback, if there is one. */
 993                 if (error > 0 && cred_cb) {
 994                         error = cred_cb(&server->cred, url_str, server->url.username, allowed_types, cred_cb_payload);
 995
 996                         /* Treat GIT_PASSTHROUGH as though git_credential_acquire_cb isn't set */
 997                         if (error == GIT_PASSTHROUGH)
 998                                 error = 1;
 999                         else if (error < 0)
1000                                 return error;
1001                 }
1002
1003                 /* Finally, invoke the fallback default credential lookup. */
1004                 if (error > 0) {
1005                         error = acquire_fallback_cred(&server->cred, url_str, allowed_types);
1006
1007                         if (error < 0)
1008                                 return error;
1009                 }
1010         }
1011
1012         /*
1013          * No error occurred but we could not find appropriate credentials.
1014          * This behaves like a pass-through.
1015          */
1016         return error;
1017 }
1018
1019 static int winhttp_stream_read(
1020         git_smart_subtransport_stream *stream,
1021         char *buffer,
1022         size_t buf_size,
1023         size_t *bytes_read)
1024 {
1025         winhttp_stream *s = (winhttp_stream *)stream;
1026         winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
1027         DWORD dw_bytes_read;
1028         char replay_count = 0;
1029         int error;
1030
1031 replay:
1032         /* Enforce a reasonable cap on the number of replays */
1033         if (replay_count++ >= GIT_HTTP_REPLAY_MAX) {
1034                 git_error_set(GIT_ERROR_HTTP, "too many redirects or authentication replays");
1035                 return GIT_ERROR; /* not GIT_EAUTH because the exact cause is not clear */
1036         }
1037
1038         /* Connect if necessary */
1039         if (!s->request && winhttp_stream_connect(s) < 0)
1040                 return -1;
1041
1042         if (!s->received_response) {
1043                 DWORD status_code, status_code_length, content_type_length, bytes_written;
1044                 char expected_content_type_8[MAX_CONTENT_TYPE_LEN];
1045                 wchar_t expected_content_type[MAX_CONTENT_TYPE_LEN], content_type[MAX_CONTENT_TYPE_LEN];
1046
1047                 if (!s->sent_request) {
1048
1049                         if ((error = send_request(s, s->post_body_len, false)) < 0)
1050                                 return error;
1051
1052                         s->sent_request = 1;
1053                 }
1054
1055                 if (s->chunked) {
1056                         GIT_ASSERT(s->verb == post_verb);
1057
1058                         /* Flush, if necessary */
1059                         if (s->chunk_buffer_len > 0 &&
1060                                 write_chunk(s->request, s->chunk_buffer, s->chunk_buffer_len) < 0)
1061                                 return -1;
1062
1063                         s->chunk_buffer_len = 0;
1064
1065                         /* Write the final chunk. */
1066                         if (!WinHttpWriteData(s->request,
1067                                 "0\r\n\r\n", 5,
1068                                 &bytes_written)) {
1069                                 git_error_set(GIT_ERROR_OS, "failed to write final chunk");
1070                                 return -1;
1071                         }
1072                 }
1073                 else if (s->post_body) {
1074                         char *buffer;
1075                         DWORD len = s->post_body_len, bytes_read;
1076
1077                         if (INVALID_SET_FILE_POINTER == SetFilePointer(s->post_body,
1078                                         0, 0, FILE_BEGIN) &&
1079                                 NO_ERROR != GetLastError()) {
1080                                 git_error_set(GIT_ERROR_OS, "failed to reset file pointer");
1081                                 return -1;
1082                         }
1083
1084                         buffer = git__malloc(CACHED_POST_BODY_BUF_SIZE);
1085                         GIT_ERROR_CHECK_ALLOC(buffer);
1086
1087                         while (len > 0) {
1088                                 DWORD bytes_written;
1089
1090                                 if (!ReadFile(s->post_body, buffer,
1091                                         min(CACHED_POST_BODY_BUF_SIZE, len),
1092                                         &bytes_read, NULL) ||
1093                                         !bytes_read) {
1094                                         git__free(buffer);
1095                                         git_error_set(GIT_ERROR_OS, "failed to read from temp file");
1096                                         return -1;
1097                                 }
1098
1099                                 if (!WinHttpWriteData(s->request, buffer,
1100                                         bytes_read, &bytes_written)) {
1101                                         git__free(buffer);
1102                                         git_error_set(GIT_ERROR_OS, "failed to write data");
1103                                         return -1;
1104                                 }
1105
1106                                 len -= bytes_read;
1107                                 GIT_ASSERT(bytes_read == bytes_written);
1108                         }
1109
1110                         git__free(buffer);
1111
1112                         /* Eagerly close the temp file */
1113                         CloseHandle(s->post_body);
1114                         s->post_body = NULL;
1115                 }
1116
1117                 if (!WinHttpReceiveResponse(s->request, 0)) {
1118                         git_error_set(GIT_ERROR_OS, "failed to receive response");
1119                         return -1;
1120                 }
1121
1122                 /* Verify that we got a 200 back */
1123                 status_code_length = sizeof(status_code);
1124
1125                 if (!WinHttpQueryHeaders(s->request,
1126                         WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER,
1127                         WINHTTP_HEADER_NAME_BY_INDEX,
1128                         &status_code, &status_code_length,
1129                         WINHTTP_NO_HEADER_INDEX)) {
1130                                 git_error_set(GIT_ERROR_OS, "failed to retrieve status code");
1131                                 return -1;
1132                 }
1133
1134                 /* The implementation of WinHTTP prior to Windows 7 will not
1135                  * redirect to an identical URI. Some Git hosters use self-redirects
1136                  * as part of their DoS mitigation strategy. Check first to see if we
1137                  * have a redirect status code, and that we haven't already streamed
1138                  * a post body. (We can't replay a streamed POST.) */
1139                 if (!s->chunked &&
1140                         (HTTP_STATUS_MOVED == status_code ||
1141                          HTTP_STATUS_REDIRECT == status_code ||
1142                          (HTTP_STATUS_REDIRECT_METHOD == status_code &&
1143                           get_verb == s->verb) ||
1144                          HTTP_STATUS_REDIRECT_KEEP_VERB == status_code ||
1145                          HTTP_STATUS_PERMANENT_REDIRECT == status_code)) {
1146
1147                         /* Check for Windows 7. This workaround is only necessary on
1148                          * Windows Vista and earlier. Windows 7 is version 6.1. */
1149                         wchar_t *location;
1150                         DWORD location_length;
1151                         char *location8;
1152
1153                         /* OK, fetch the Location header from the redirect. */
1154                         if (WinHttpQueryHeaders(s->request,
1155                                 WINHTTP_QUERY_LOCATION,
1156                                 WINHTTP_HEADER_NAME_BY_INDEX,
1157                                 WINHTTP_NO_OUTPUT_BUFFER,
1158                                 &location_length,
1159                                 WINHTTP_NO_HEADER_INDEX) ||
1160                                 GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
1161                                 git_error_set(GIT_ERROR_OS, "failed to read Location header");
1162                                 return -1;
1163                         }
1164
1165                         location = git__malloc(location_length);
1166                         GIT_ERROR_CHECK_ALLOC(location);
1167
1168                         if (!WinHttpQueryHeaders(s->request,
1169                                 WINHTTP_QUERY_LOCATION,
1170                                 WINHTTP_HEADER_NAME_BY_INDEX,
1171                                 location,
1172                                 &location_length,
1173                                 WINHTTP_NO_HEADER_INDEX)) {
1174                                 git_error_set(GIT_ERROR_OS, "failed to read Location header");
1175                                 git__free(location);
1176                                 return -1;
1177                         }
1178
1179                         /* Convert the Location header to UTF-8 */
1180                         if (git__utf16_to_8_alloc(&location8, location) < 0) {
1181                                 git_error_set(GIT_ERROR_OS, "failed to convert Location header to UTF-8");
1182                                 git__free(location);
1183                                 return -1;
1184                         }
1185
1186                         git__free(location);
1187
1188                         /* Replay the request */
1189                         winhttp_stream_close(s);
1190
1191                         if (!git__prefixcmp_icase(location8, prefix_https)) {
1192                                 bool follow = (t->owner->connect_opts.follow_redirects != GIT_REMOTE_REDIRECT_NONE);
1193
1194                                 /* Upgrade to secure connection; disconnect and start over */
1195                                 if (git_net_url_apply_redirect(&t->server.url, location8, follow, s->service_url) < 0) {
1196                                         git__free(location8);
1197                                         return -1;
1198                                 }
1199
1200                                 winhttp_close_connection(t);
1201
1202                                 if (winhttp_connect(t) < 0)
1203                                         return -1;
1204                         }
1205
1206                         git__free(location8);
1207                         goto replay;
1208                 }
1209
1210                 /* Handle authentication failures */
1211                 if (status_code == HTTP_STATUS_DENIED) {
1212                         int error = acquire_credentials(s->request,
1213                                 &t->server,
1214                                 t->owner->url,
1215                                 t->owner->connect_opts.callbacks.credentials,
1216                                 t->owner->connect_opts.callbacks.payload);
1217
1218                         if (error < 0) {
1219                                 return error;
1220                         } else if (!error) {
1221                                 GIT_ASSERT(t->server.cred);
1222                                 winhttp_stream_close(s);
1223                                 goto replay;
1224                         }
1225                 } else if (status_code == HTTP_STATUS_PROXY_AUTH_REQ) {
1226                         int error = acquire_credentials(s->request,
1227                                 &t->proxy,
1228                                 t->owner->connect_opts.proxy_opts.url,
1229                                 t->owner->connect_opts.proxy_opts.credentials,
1230                                 t->owner->connect_opts.proxy_opts.payload);
1231
1232                         if (error < 0) {
1233                                 return error;
1234                         } else if (!error) {
1235                                 GIT_ASSERT(t->proxy.cred);
1236                                 winhttp_stream_close(s);
1237                                 goto replay;
1238                         }
1239                 }
1240
1241                 if (HTTP_STATUS_OK != status_code) {
1242                         git_error_set(GIT_ERROR_HTTP, "request failed with status code: %lu", status_code);
1243                         return -1;
1244                 }
1245
1246                 /* Verify that we got the correct content-type back */
1247                 if (post_verb == s->verb)
1248                         p_snprintf(expected_content_type_8, MAX_CONTENT_TYPE_LEN, "application/x-git-%s-result", s->service);
1249                 else
1250                         p_snprintf(expected_content_type_8, MAX_CONTENT_TYPE_LEN, "application/x-git-%s-advertisement", s->service);
1251
1252                 if (git__utf8_to_16(expected_content_type, MAX_CONTENT_TYPE_LEN, expected_content_type_8) < 0) {
1253                         git_error_set(GIT_ERROR_OS, "failed to convert expected content-type to wide characters");
1254                         return -1;
1255                 }
1256
1257                 content_type_length = sizeof(content_type);
1258
1259                 if (!WinHttpQueryHeaders(s->request,
1260                         WINHTTP_QUERY_CONTENT_TYPE,
1261                         WINHTTP_HEADER_NAME_BY_INDEX,
1262                         &content_type, &content_type_length,
1263                         WINHTTP_NO_HEADER_INDEX)) {
1264                                 git_error_set(GIT_ERROR_OS, "failed to retrieve response content-type");
1265                                 return -1;
1266                 }
1267
1268                 if (wcscmp(expected_content_type, content_type)) {
1269                         git_error_set(GIT_ERROR_HTTP, "received unexpected content-type");
1270                         return -1;
1271                 }
1272
1273                 s->received_response = 1;
1274         }
1275
1276         if (!WinHttpReadData(s->request,
1277                 (LPVOID)buffer,
1278                 (DWORD)buf_size,
1279                 &dw_bytes_read))
1280         {
1281                 git_error_set(GIT_ERROR_OS, "failed to read data");
1282                 return -1;
1283         }
1284
1285         *bytes_read = dw_bytes_read;
1286
1287         return 0;
1288 }
1289
1290 static int winhttp_stream_write_single(
1291         git_smart_subtransport_stream *stream,
1292         const char *buffer,
1293         size_t len)
1294 {
1295         winhttp_stream *s = (winhttp_stream *)stream;
1296         DWORD bytes_written;
1297         int error;
1298
1299         if (!s->request && winhttp_stream_connect(s) < 0)
1300                 return -1;
1301
1302         /* This implementation of write permits only a single call. */
1303         if (s->sent_request) {
1304                 git_error_set(GIT_ERROR_HTTP, "subtransport configured for only one write");
1305                 return -1;
1306         }
1307
1308         if ((error = send_request(s, len, false)) < 0)
1309                 return error;
1310
1311         s->sent_request = 1;
1312
1313         if (!WinHttpWriteData(s->request,
1314                         (LPCVOID)buffer,
1315                         (DWORD)len,
1316                         &bytes_written)) {
1317                 git_error_set(GIT_ERROR_OS, "failed to write data");
1318                 return -1;
1319         }
1320
1321         GIT_ASSERT((DWORD)len == bytes_written);
1322
1323         return 0;
1324 }
1325
1326 static int put_uuid_string(LPWSTR buffer, size_t buffer_len_cch)
1327 {
1328         UUID uuid;
1329         RPC_STATUS status = UuidCreate(&uuid);
1330         int result;
1331
1332         if (RPC_S_OK != status &&
1333                 RPC_S_UUID_LOCAL_ONLY != status &&
1334                 RPC_S_UUID_NO_ADDRESS != status) {
1335                 git_error_set(GIT_ERROR_HTTP, "unable to generate name for temp file");
1336                 return -1;
1337         }
1338
1339         if (buffer_len_cch < UUID_LENGTH_CCH + 1) {
1340                 git_error_set(GIT_ERROR_HTTP, "buffer too small for name of temp file");
1341                 return -1;
1342         }
1343
1344 #if !defined(__MINGW32__) || defined(MINGW_HAS_SECURE_API)
1345         result = swprintf_s(buffer, buffer_len_cch,
1346 #else
1347         result = wsprintfW(buffer,
1348 #endif
1349                 L"%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x",
1350                 uuid.Data1, uuid.Data2, uuid.Data3,
1351                 uuid.Data4[0], uuid.Data4[1], uuid.Data4[2], uuid.Data4[3],
1352                 uuid.Data4[4], uuid.Data4[5], uuid.Data4[6], uuid.Data4[7]);
1353
1354         if (result < UUID_LENGTH_CCH) {
1355                 git_error_set(GIT_ERROR_OS, "unable to generate name for temp file");
1356                 return -1;
1357         }
1358
1359         return 0;
1360 }
1361
1362 static int get_temp_file(LPWSTR buffer, DWORD buffer_len_cch)
1363 {
1364         size_t len;
1365
1366         if (!GetTempPathW(buffer_len_cch, buffer)) {
1367                 git_error_set(GIT_ERROR_OS, "failed to get temp path");
1368                 return -1;
1369         }
1370
1371         len = wcslen(buffer);
1372
1373         if (buffer[len - 1] != '\\' && len < buffer_len_cch)
1374                 buffer[len++] = '\\';
1375
1376         if (put_uuid_string(&buffer[len], (size_t)buffer_len_cch - len) < 0)
1377                 return -1;
1378
1379         return 0;
1380 }
1381
1382 static int winhttp_stream_write_buffered(
1383         git_smart_subtransport_stream *stream,
1384         const char *buffer,
1385         size_t len)
1386 {
1387         winhttp_stream *s = (winhttp_stream *)stream;
1388         DWORD bytes_written;
1389
1390         if (!s->request && winhttp_stream_connect(s) < 0)
1391                 return -1;
1392
1393         /* Buffer the payload, using a temporary file so we delegate
1394          * memory management of the data to the operating system. */
1395         if (!s->post_body) {
1396                 wchar_t temp_path[MAX_PATH + 1];
1397
1398                 if (get_temp_file(temp_path, MAX_PATH + 1) < 0)
1399                         return -1;
1400
1401                 s->post_body = CreateFileW(temp_path,
1402                         GENERIC_READ | GENERIC_WRITE,
1403                         FILE_SHARE_DELETE, NULL,
1404                         CREATE_NEW,
1405                         FILE_ATTRIBUTE_TEMPORARY | FILE_FLAG_DELETE_ON_CLOSE | FILE_FLAG_SEQUENTIAL_SCAN,
1406                         NULL);
1407
1408                 if (INVALID_HANDLE_VALUE == s->post_body) {
1409                         s->post_body = NULL;
1410                         git_error_set(GIT_ERROR_OS, "failed to create temporary file");
1411                         return -1;
1412                 }
1413         }
1414
1415         if (!WriteFile(s->post_body, buffer, (DWORD)len, &bytes_written, NULL)) {
1416                 git_error_set(GIT_ERROR_OS, "failed to write to temporary file");
1417                 return -1;
1418         }
1419
1420         GIT_ASSERT((DWORD)len == bytes_written);
1421
1422         s->post_body_len += bytes_written;
1423
1424         return 0;
1425 }
1426
1427 static int winhttp_stream_write_chunked(
1428         git_smart_subtransport_stream *stream,
1429         const char *buffer,
1430         size_t len)
1431 {
1432         winhttp_stream *s = (winhttp_stream *)stream;
1433         int error;
1434
1435         if (!s->request && winhttp_stream_connect(s) < 0)
1436                 return -1;
1437
1438         if (!s->sent_request) {
1439                 /* Send Transfer-Encoding: chunked header */
1440                 if (!WinHttpAddRequestHeaders(s->request,
1441                         transfer_encoding, (ULONG) -1L,
1442                         WINHTTP_ADDREQ_FLAG_ADD)) {
1443                         git_error_set(GIT_ERROR_OS, "failed to add a header to the request");
1444                         return -1;
1445                 }
1446
1447                 if ((error = send_request(s, 0, true)) < 0)
1448                         return error;
1449
1450                 s->sent_request = 1;
1451         }
1452
1453         if (len > CACHED_POST_BODY_BUF_SIZE) {
1454                 /* Flush, if necessary */
1455                 if (s->chunk_buffer_len > 0) {
1456                         if (write_chunk(s->request, s->chunk_buffer, s->chunk_buffer_len) < 0)
1457                                 return -1;
1458
1459                         s->chunk_buffer_len = 0;
1460                 }
1461
1462                 /* Write chunk directly */
1463                 if (write_chunk(s->request, buffer, len) < 0)
1464                         return -1;
1465         }
1466         else {
1467                 /* Append as much to the buffer as we can */
1468                 int count = (int)min(CACHED_POST_BODY_BUF_SIZE - s->chunk_buffer_len, len);
1469
1470                 if (!s->chunk_buffer) {
1471                         s->chunk_buffer = git__malloc(CACHED_POST_BODY_BUF_SIZE);
1472                         GIT_ERROR_CHECK_ALLOC(s->chunk_buffer);
1473                 }
1474
1475                 memcpy(s->chunk_buffer + s->chunk_buffer_len, buffer, count);
1476                 s->chunk_buffer_len += count;
1477                 buffer += count;
1478                 len -= count;
1479
1480                 /* Is the buffer full? If so, then flush */
1481                 if (CACHED_POST_BODY_BUF_SIZE == s->chunk_buffer_len) {
1482                         if (write_chunk(s->request, s->chunk_buffer, s->chunk_buffer_len) < 0)
1483                                 return -1;
1484
1485                         s->chunk_buffer_len = 0;
1486
1487                         /* Is there any remaining data from the source? */
1488                         if (len > 0) {
1489                                 memcpy(s->chunk_buffer, buffer, len);
1490                                 s->chunk_buffer_len = (unsigned int)len;
1491                         }
1492                 }
1493         }
1494
1495         return 0;
1496 }
1497
1498 static void winhttp_stream_free(git_smart_subtransport_stream *stream)
1499 {
1500         winhttp_stream *s = (winhttp_stream *)stream;
1501
1502         winhttp_stream_close(s);
1503         git__free(s);
1504 }
1505
1506 static int winhttp_stream_alloc(winhttp_subtransport *t, winhttp_stream **stream)
1507 {
1508         winhttp_stream *s;
1509
1510         if (!stream)
1511                 return -1;
1512
1513         s = git__calloc(1, sizeof(winhttp_stream));
1514         GIT_ERROR_CHECK_ALLOC(s);
1515
1516         s->parent.subtransport = &t->parent;
1517         s->parent.read = winhttp_stream_read;
1518         s->parent.write = winhttp_stream_write_single;
1519         s->parent.free = winhttp_stream_free;
1520
1521         *stream = s;
1522
1523         return 0;
1524 }
1525
1526 static int winhttp_uploadpack_ls(
1527         winhttp_subtransport *t,
1528         winhttp_stream *s)
1529 {
1530         GIT_UNUSED(t);
1531
1532         s->service = upload_pack_service;
1533         s->service_url = upload_pack_ls_service_url;
1534         s->verb = get_verb;
1535
1536         return 0;
1537 }
1538
1539 static int winhttp_uploadpack(
1540         winhttp_subtransport *t,
1541         winhttp_stream *s)
1542 {
1543         GIT_UNUSED(t);
1544
1545         s->service = upload_pack_service;
1546         s->service_url = upload_pack_service_url;
1547         s->verb = post_verb;
1548
1549         return 0;
1550 }
1551
1552 static int winhttp_receivepack_ls(
1553         winhttp_subtransport *t,
1554         winhttp_stream *s)
1555 {
1556         GIT_UNUSED(t);
1557
1558         s->service = receive_pack_service;
1559         s->service_url = receive_pack_ls_service_url;
1560         s->verb = get_verb;
1561
1562         return 0;
1563 }
1564
1565 static int winhttp_receivepack(
1566         winhttp_subtransport *t,
1567         winhttp_stream *s)
1568 {
1569         GIT_UNUSED(t);
1570
1571         /* WinHTTP only supports Transfer-Encoding: chunked
1572          * on Windows Vista (NT 6.0) and higher. */
1573         s->chunked = git_has_win32_version(6, 0, 0);
1574
1575         if (s->chunked)
1576                 s->parent.write = winhttp_stream_write_chunked;
1577         else
1578                 s->parent.write = winhttp_stream_write_buffered;
1579
1580         s->service = receive_pack_service;
1581         s->service_url = receive_pack_service_url;
1582         s->verb = post_verb;
1583
1584         return 0;
1585 }
1586
1587 static int winhttp_action(
1588         git_smart_subtransport_stream **stream,
1589         git_smart_subtransport *subtransport,
1590         const char *url,
1591         git_smart_service_t action)
1592 {
1593         winhttp_subtransport *t = (winhttp_subtransport *)subtransport;
1594         winhttp_stream *s;
1595         int ret = -1;
1596
1597         if (!t->connection)
1598                 if ((ret = git_net_url_parse(&t->server.url, url)) < 0 ||
1599                          (ret = winhttp_connect(t)) < 0)
1600                         return ret;
1601
1602         if (winhttp_stream_alloc(t, &s) < 0)
1603                 return -1;
1604
1605         if (!stream)
1606                 return -1;
1607
1608         switch (action)
1609         {
1610                 case GIT_SERVICE_UPLOADPACK_LS:
1611                         ret = winhttp_uploadpack_ls(t, s);
1612                         break;
1613
1614                 case GIT_SERVICE_UPLOADPACK:
1615                         ret = winhttp_uploadpack(t, s);
1616                         break;
1617
1618                 case GIT_SERVICE_RECEIVEPACK_LS:
1619                         ret = winhttp_receivepack_ls(t, s);
1620                         break;
1621
1622                 case GIT_SERVICE_RECEIVEPACK:
1623                         ret = winhttp_receivepack(t, s);
1624                         break;
1625
1626                 default:
1627                         GIT_ASSERT(0);
1628         }
1629
1630         if (!ret)
1631                 *stream = &s->parent;
1632
1633         return ret;
1634 }
1635
1636 static int winhttp_close(git_smart_subtransport *subtransport)
1637 {
1638         winhttp_subtransport *t = (winhttp_subtransport *)subtransport;
1639
1640         git_net_url_dispose(&t->server.url);
1641         git_net_url_dispose(&t->proxy.url);
1642
1643         if (t->server.cred) {
1644                 t->server.cred->free(t->server.cred);
1645                 t->server.cred = NULL;
1646         }
1647
1648         if (t->proxy.cred) {
1649                 t->proxy.cred->free(t->proxy.cred);
1650                 t->proxy.cred = NULL;
1651         }
1652
1653         return winhttp_close_connection(t);
1654 }
1655
1656 static void winhttp_free(git_smart_subtransport *subtransport)
1657 {
1658         winhttp_subtransport *t = (winhttp_subtransport *)subtransport;
1659
1660         winhttp_close(subtransport);
1661
1662         git__free(t);
1663 }
1664
1665 int git_smart_subtransport_http(git_smart_subtransport **out, git_transport *owner, void *param)
1666 {
1667         winhttp_subtransport *t;
1668
1669         GIT_UNUSED(param);
1670
1671         if (!out)
1672                 return -1;
1673
1674         t = git__calloc(1, sizeof(winhttp_subtransport));
1675         GIT_ERROR_CHECK_ALLOC(t);
1676
1677         t->owner = (transport_smart *)owner;
1678         t->parent.action = winhttp_action;
1679         t->parent.close = winhttp_close;
1680         t->parent.free = winhttp_free;
1681
1682         *out = (git_smart_subtransport *) t;
1683         return 0;
1684 }
1685
1686 #endif /* GIT_WINHTTP */