winhttp: support default credentials for proxies

We did not properly support default credentials for proxies, only for
destination servers.  Refactor the credential handling to support sending
either username/password _or_ default credentials to either the proxy or
the destination server.

This actually shares the authentication logic between proxy servers and
destination servers.  Due to copy/pasta drift over time, they had
diverged.  Now they share a common logic which is: first, use
credentials specified in the URL (if there were any), treating empty
username and password (ie, "http://:@foo.com/") as default credentials,
for compatibility with git.  Next, call the credential callbacks.
Finally, fallback to WinHTTP compatibility layers using built-in
authentication like we always have.

Allowing default credentials for proxies requires moving the security
level downgrade into the credential setting routines themselves.
We will update our security level to "high" by default which means that
we will never send default credentials without prompting.  (A lower
setting, like the WinHTTP default of "medium" would allow WinHTTP to
handle credentials for us, despite what a user may have requested with
their structures.)  Now we start with "high" and downgrade to "low" only
after a user has explicitly requested default credentials.

2 files changed, 221 insertions, 189 deletions

diff --git a/src/transports/winhttp.c b/src/transports/winhttp.c
index 395a1a10d..6392a7d1c 100644
--- a/src/transports/winhttp.c
+++ b/src/transports/winhttp.c
@@ -101,23 +101,43 @@ typedef struct {
 } winhttp_stream;
 
 typedef struct {
-	git_smart_subtransport parent;
-	transport_smart *owner;
 	git_net_url url;
-	git_net_url proxy_url;
 	git_cred *cred;
-	git_cred *url_cred;
-	git_cred *proxy_cred;
 	int auth_mechanisms;
+	bool url_cred_presented;
+} winhttp_server;
+
+typedef struct {
+	git_smart_subtransport parent;
+	transport_smart *owner;
+
+	winhttp_server server;
+	winhttp_server proxy;
+
 	HINTERNET session;
 	HINTERNET connection;
 } winhttp_subtransport;
 
-static int _apply_userpass_credential(HINTERNET request, DWORD target, DWORD scheme, git_cred *cred)
+static int apply_userpass_credentials(HINTERNET request, DWORD target, int mechanisms, git_cred *cred)
 {
 	git_cred_userpass_plaintext *c = (git_cred_userpass_plaintext *)cred;
-	wchar_t *user, *pass;
+	wchar_t *user = NULL, *pass = NULL;
 	int user_len = 0, pass_len = 0, error = 0;
+	DWORD native_scheme;
+
+	if (mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) {
+		native_scheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
+	} else if (mechanisms & GIT_WINHTTP_AUTH_NTLM) {
+		native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
+	} else if (mechanisms & GIT_WINHTTP_AUTH_DIGEST) {
+		native_scheme = WINHTTP_AUTH_SCHEME_DIGEST;
+	} else if (mechanisms & GIT_WINHTTP_AUTH_BASIC) {
+		native_scheme = WINHTTP_AUTH_SCHEME_BASIC;
+	} else {
+		git_error_set(GIT_ERROR_NET, "invalid authentication scheme");
+		error = -1;
+		goto done;
+	}
 
 	if ((error = user_len = git__utf8_to_16_alloc(&user, c->username)) < 0)
 		goto done;
@@ -125,7 +145,7 @@ static int _apply_userpass_credential(HINTERNET request, DWORD target, DWORD sch
 	if ((error = pass_len = git__utf8_to_16_alloc(&pass, c->password)) < 0)
 		goto done;
 
-	if (!WinHttpSetCredentials(request, target, scheme, user, pass, NULL)) {
+	if (!WinHttpSetCredentials(request, target, native_scheme, user, pass, NULL)) {
 		git_error_set(GIT_ERROR_OS, "failed to set credentials");
 		error = -1;
 	}
@@ -143,77 +163,58 @@ done:
 	return error;
 }
 
-static int apply_userpass_credential_proxy(HINTERNET request, git_cred *cred, int mechanisms)
-{
-	if (GIT_WINHTTP_AUTH_DIGEST & mechanisms) {
-		return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_PROXY,
-			WINHTTP_AUTH_SCHEME_DIGEST, cred);
-	}
-
-	return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_PROXY,
-		WINHTTP_AUTH_SCHEME_BASIC, cred);
-}
-
-static int apply_userpass_credential(HINTERNET request, int mechanisms, git_cred *cred)
+static int apply_default_credentials(HINTERNET request, DWORD target, int mechanisms)
 {
-	DWORD native_scheme;
+	DWORD autologon_level = WINHTTP_AUTOLOGON_SECURITY_LEVEL_LOW;
+	DWORD native_scheme = 0;
 
-	if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) ||
-		(mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE)) {
+	if ((mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) != 0) {
+		native_scheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
+	} else if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) != 0) {
 		native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
-	} else if (mechanisms & GIT_WINHTTP_AUTH_BASIC) {
-		native_scheme = WINHTTP_AUTH_SCHEME_BASIC;
 	} else {
 		git_error_set(GIT_ERROR_NET, "invalid authentication scheme");
 		return -1;
 	}
 
-	return _apply_userpass_credential(request, WINHTTP_AUTH_TARGET_SERVER,
-		native_scheme, cred);
-}
-
-static int apply_default_credentials(HINTERNET request, int mechanisms)
-{
-	/* Either the caller explicitly requested that default credentials be passed,
-	 * or our fallback credential callback was invoked and checked that the target
-	 * URI was in the appropriate Internet Explorer security zone. By setting this
-	 * flag, we guarantee that the credentials are delivered by WinHTTP. The default
-	 * is "medium" which applies to the intranet and sounds like it would correspond
-	 * to Internet Explorer security zones, but in fact does not. */
-	DWORD data = WINHTTP_AUTOLOGON_SECURITY_LEVEL_LOW;
-	DWORD native_scheme = 0;
-
-	if ((mechanisms & GIT_WINHTTP_AUTH_NTLM) != 0)
-		native_scheme = WINHTTP_AUTH_SCHEME_NTLM;
-
-	if ((mechanisms & GIT_WINHTTP_AUTH_NEGOTIATE) != 0)
-		native_scheme = WINHTTP_AUTH_SCHEME_NEGOTIATE;
-
-	if (!native_scheme) {
-		git_error_set(GIT_ERROR_NET, "invalid authentication scheme");
+	/*
+	 * Autologon policy must be "low" to use default creds.
+	 * This is safe as the user has explicitly requested it.
+	 */
+	if (!WinHttpSetOption(request, WINHTTP_OPTION_AUTOLOGON_POLICY, &autologon_level, sizeof(DWORD))) {
+		git_error_set(GIT_ERROR_OS, "could not configure logon policy");
 		return -1;
 	}
 
-	if (!WinHttpSetOption(request, WINHTTP_OPTION_AUTOLOGON_POLICY, &data, sizeof(DWORD)))
-		return -1;
-
-	if (!WinHttpSetCredentials(request, WINHTTP_AUTH_TARGET_SERVER, native_scheme, NULL, NULL, NULL))
+	if (!WinHttpSetCredentials(request, target, native_scheme, NULL, NULL, NULL)) {
+		git_error_set(GIT_ERROR_OS, "could not configure credentials");
 		return -1;
+	}
 
 	return 0;
 }
 
-static int fallback_cred_acquire_cb(
+static int acquire_url_cred(
 	git_cred **cred,
-	const char *url,
-	const char *username_from_url,
 	unsigned int allowed_types,
-	void *payload)
+	const char *username,
+	const char *password)
 {
-	int error = 1;
+	if (allowed_types & GIT_CREDTYPE_USERPASS_PLAINTEXT)
+		return git_cred_userpass_plaintext_new(cred, username, password);
+
+	if ((allowed_types & GIT_CREDTYPE_DEFAULT) && *username == '\0' && *password == '\0')
+		return git_cred_default_new(cred);
+
+	return 1;
+}
 
-	GIT_UNUSED(username_from_url);
-	GIT_UNUSED(payload);
+static int acquire_fallback_cred(
+	git_cred **cred,
+	const char *url,
+	unsigned int allowed_types)
+{
+	int error = 1;
 
 	/* If the target URI supports integrated Windows authentication
 	 * as an authentication mechanism */
@@ -253,9 +254,9 @@ static int fallback_cred_acquire_cb(
 				pISM->lpVtbl->Release(pISM);
 			}
 
-            if (SUCCEEDED(hCoInitResult))
-                /* Only unitialize if the call to CoInitializeEx was successful. */
-                CoUninitialize();
+			/* Only unitialize if the call to CoInitializeEx was successful. */
+			if (SUCCEEDED(hCoInitResult))
+				CoUninitialize();
 		}
 
 		git__free(wide_url);
@@ -280,7 +281,7 @@ static int certificate_check(winhttp_stream *s, int valid)
 		return GIT_ECERTIFICATE;
 	}
 
-	if (t->owner->certificate_check_cb == NULL || git__strcmp(t->url.scheme, "https") != 0)
+	if (t->owner->certificate_check_cb == NULL || git__strcmp(t->server.url.scheme, "https") != 0)
 		return 0;
 
 	if (!WinHttpQueryOption(s->request, WINHTTP_OPTION_SERVER_CERT_CONTEXT, &cert_ctx, &cert_ctx_size)) {
@@ -292,7 +293,7 @@ static int certificate_check(winhttp_stream *s, int valid)
 	cert.parent.cert_type = GIT_CERT_X509;
 	cert.data = cert_ctx->pbCertEncoded;
 	cert.len = cert_ctx->cbCertEncoded;
-	error = t->owner->certificate_check_cb((git_cert *) &cert, valid, t->url.host, t->owner->message_cb_payload);
+	error = t->owner->certificate_check_cb((git_cert *) &cert, valid, t->server.url.host, t->owner->message_cb_payload);
 	CertFreeCertificateContext(cert_ctx);
 
 	if (error == GIT_PASSTHROUGH)
@@ -329,6 +330,24 @@ static void winhttp_stream_close(winhttp_stream *s)
 	s->sent_request = 0;
 }
 
+static int apply_credentials(
+	HINTERNET request,
+	git_net_url *url,
+	int target,
+	git_cred *creds,
+	int mechanisms)
+{
+	int error = 0;
+
+	/* If we have creds, just apply them */
+	if (creds && creds->credtype == GIT_CREDTYPE_USERPASS_PLAINTEXT)
+		error = apply_userpass_credentials(request, target, mechanisms, creds);
+	else if (creds && creds->credtype == GIT_CREDTYPE_DEFAULT)
+		error = apply_default_credentials(request, target, mechanisms);
+
+	return error;
+}
+
 static int winhttp_stream_connect(winhttp_stream *s)
 {
 	winhttp_subtransport *t = OWNING_SUBTRANSPORT(s);
@@ -341,11 +360,13 @@ static int winhttp_stream_connect(winhttp_stream *s)
 	unsigned long disable_redirects = WINHTTP_DISABLE_REDIRECTS;
 	int default_timeout = TIMEOUT_INFINITE;
 	int default_connect_timeout = DEFAULT_CONNECT_TIMEOUT;
+	DWORD autologon_policy = WINHTTP_AUTOLOGON_SECURITY_LEVEL_HIGH;
+
 	size_t i;
 	const git_proxy_options *proxy_opts;
 
 	/* Prepare URL */
-	git_buf_printf(&buf, "%s%s", t->url.path, s->service_url);
+	git_buf_printf(&buf, "%s%s", t->server.url.path, s->service_url);
 
 	if (git_buf_oom(&buf))
 		return -1;
@@ -364,13 +385,17 @@ static int winhttp_stream_connect(winhttp_stream *s)
 			NULL,
 			WINHTTP_NO_REFERER,
 			types,
-			git__strcmp(t->url.scheme, "https") == 0 ? WINHTTP_FLAG_SECURE : 0);
+			git__strcmp(t->server.url.scheme, "https") == 0 ? WINHTTP_FLAG_SECURE : 0);
 
 	if (!s->request) {
 		git_error_set(GIT_ERROR_OS, "failed to open request");
 		goto on_error;
 	}
 
+	/* Never attempt default credentials; we'll provide them explicitly. */
+	if (!WinHttpSetOption(s->request, WINHTTP_OPTION_AUTOLOGON_POLICY, &autologon_policy, sizeof(DWORD)))
+		return -1;
+
 	if (!WinHttpSetTimeouts(s->request, default_timeout, default_connect_timeout, default_timeout, default_timeout)) {
 		git_error_set(GIT_ERROR_OS, "failed to set timeouts for WinHTTP");
 		goto on_error;
@@ -379,7 +404,7 @@ static int winhttp_stream_connect(winhttp_stream *s)
 	proxy_opts = &t->owner->proxy;
 	if (proxy_opts->type == GIT_PROXY_AUTO) {
 		/* Set proxy if necessary */
-		if (git_remote__get_http_proxy(t->owner->owner, (strcmp(t->url.scheme, "https") == 0), &proxy_url) < 0)
+		if (git_remote__get_http_proxy(t->owner->owner, (strcmp(t->server.url.scheme, "https") == 0), &proxy_url) < 0)
 			goto on_error;
 	}
 	else if (proxy_opts->type == GIT_PROXY_SPECIFIED) {
@@ -392,33 +417,24 @@ static int winhttp_stream_connect(winhttp_stream *s)
 		WINHTTP_PROXY_INFO proxy_info;
 		wchar_t *proxy_wide;
 
-		git_net_url_dispose(&t->proxy_url);
+		git_net_url_dispose(&t->proxy.url);
 
-		if ((error = git_net_url_parse(&t->proxy_url, proxy_url)) < 0)
+		if ((error = git_net_url_parse(&t->proxy.url, proxy_url)) < 0)
 			goto on_error;
 
-		if (strcmp(t->proxy_url.scheme, "http") != 0 && strcmp(t->proxy_url.scheme, "https") != 0) {
+		if (strcmp(t->proxy.url.scheme, "http") != 0 && strcmp(t->proxy.url.scheme, "https") != 0) {
 			git_error_set(GIT_ERROR_NET, "invalid URL: '%s'", proxy_url);
 			error = -1;
 			goto on_error;
 		}
 
-		if (t->proxy_url.username && t->proxy_url.password) {
-			if (t->proxy_cred) {
-				t->proxy_cred->free(t->proxy_cred);
-			}
-
-			if ((error = git_cred_userpass_plaintext_new(&t->proxy_cred, t->proxy_url.username, t->proxy_url.password)) < 0)
-				goto on_error;
-		}
-
-		git_buf_puts(&processed_url, t->proxy_url.scheme);
+		git_buf_puts(&processed_url, t->proxy.url.scheme);
 		git_buf_PUTS(&processed_url, "://");
 
-		git_buf_puts(&processed_url, t->proxy_url.host);
+		git_buf_puts(&processed_url, t->proxy.url.host);
 
-		if (!git_net_url_is_default_port(&t->proxy_url))
-			git_buf_printf(&processed_url, ":%s", t->proxy_url.port);
+		if (!git_net_url_is_default_port(&t->proxy.url))
+			git_buf_printf(&processed_url, ":%s", t->proxy.url.port);
 
 		if (git_buf_oom(&processed_url)) {
 			error = -1;
@@ -446,13 +462,8 @@ static int winhttp_stream_connect(winhttp_stream *s)
 
 		git__free(proxy_wide);
 
-		if (t->proxy_cred) {
-			if (t->proxy_cred->credtype == GIT_CREDTYPE_USERPASS_PLAINTEXT) {
-				if ((error = apply_userpass_credential_proxy(s->request, t->proxy_cred, t->auth_mechanisms)) < 0)
-					goto on_error;
-			}
-		}
-
+		if ((error = apply_credentials(s->request, &t->proxy.url, WINHTTP_AUTH_TARGET_PROXY, t->proxy.cred, t->proxy.auth_mechanisms)) < 0)
+			goto on_error;
 	}
 
 	/* Disable WinHTTP redirects so we can handle them manually. Why, you ask?
@@ -463,6 +474,7 @@ static int winhttp_stream_connect(winhttp_stream *s)
 		&disable_redirects,
 		sizeof(disable_redirects))) {
 			git_error_set(GIT_ERROR_OS, "failed to disable redirects");
+			error = -1;
 			goto on_error;
 	}
 
@@ -535,33 +547,16 @@ static int winhttp_stream_connect(winhttp_stream *s)
 	}
 
 	/* If requested, disable certificate validation */
-	if (strcmp(t->url.scheme, "https") == 0) {
+	if (strcmp(t->server.url.scheme, "https") == 0) {
 		int flags;
 
 		if (t->owner->parent.read_flags(&t->owner->parent, &flags) < 0)
 			goto on_error;
 	}
 
-	/* If we have a credential on the subtransport, apply it to the request */
-	if (t->cred &&
-		t->cred->credtype == GIT_CREDTYPE_USERPASS_PLAINTEXT &&
-		apply_userpass_credential(s->request, t->auth_mechanisms, t->cred) < 0)
-		goto on_error;
-	else if (t->cred &&
-		t->cred->credtype == GIT_CREDTYPE_DEFAULT &&
-		apply_default_credentials(s->request, t->auth_mechanisms) < 0)
+	if ((error = apply_credentials(s->request, &t->server.url, WINHTTP_AUTH_TARGET_SERVER, t->server.cred, t->server.auth_mechanisms)) < 0)
 		goto on_error;
 
-	/* If no other credentials have been applied and the URL has username and
-	 * password, use those */
-	if (!t->cred && t->url.username && t->url.password) {
-		if (!t->url_cred &&
-			git_cred_userpass_plaintext_new(&t->url_cred, t->url.username, t->url.password) < 0)
-			goto on_error;
-		if (apply_userpass_credential(s->request, GIT_WINHTTP_AUTH_BASIC, t->url_cred) < 0)
-			goto on_error;
-	}
-
 	/* We've done everything up to calling WinHttpSendRequest. */
 
 	error = 0;
@@ -576,9 +571,9 @@ on_error:
 }
 
 static int parse_unauthorized_response(
-	HINTERNET request,
 	int *allowed_types,
-	int *allowed_mechanisms)
+	int *allowed_mechanisms,
+	HINTERNET request)
 {
 	DWORD supported, first, target;
 
@@ -733,12 +728,12 @@ static int winhttp_connect(
 	t->connection = NULL;
 
 	/* Prepare port */
-	if (git__strntol32(&port, t->url.port,
-			   strlen(t->url.port), NULL, 10) < 0)
+	if (git__strntol32(&port, t->server.url.port,
+			   strlen(t->server.url.port), NULL, 10) < 0)
 		return -1;
 
 	/* Prepare host */
-	if (git__utf8_to_16_alloc(&wide_host, t->url.host) < 0) {
+	if (git__utf8_to_16_alloc(&wide_host, t->server.url.host) < 0) {
 		git_error_set(GIT_ERROR_OS, "unable to convert host to wide characters");
 		return -1;
 	}
@@ -882,6 +877,59 @@ static int send_request(winhttp_stream *s, size_t len, int ignore_length)
 	return error;
 }
 
+static int acquire_credentials(
+	HINTERNET request,
+	winhttp_server *server,
+	const char *url_str,
+	git_cred_acquire_cb cred_cb,
+	void *cred_cb_payload)
+{
+	int allowed_types;
+	int error = 1;
+
+	if (parse_unauthorized_response(&allowed_types, &server->auth_mechanisms, request) < 0)
+		return -1;
+
+	if (allowed_types) {
+		git_cred_free(server->cred);
+		server->cred = NULL;
+
+		/* Start with URL-specified credentials, if there were any. */
+		if (!server->url_cred_presented && server->url.username && server->url.password) {
+			error = acquire_url_cred(&server->cred, allowed_types, server->url.username, server->url.password);
+			server->url_cred_presented = 1;
+
+			if (error < 0)
+				return error;
+		}
+
+		/* Next use the user-defined callback, if there is one. */
+		if (error > 0 && cred_cb) {
+			error = cred_cb(&server->cred, url_str, server->url.username, allowed_types, cred_cb_payload);
+
+			/* Treat GIT_PASSTHROUGH as though git_cred_acquire_cb isn't set */
+			if (error == GIT_PASSTHROUGH)
+				error = 1;
+			else if (error < 0)
+				return error;
+		}
+
+		/* Finally, invoke the fallback default credential lookup. */
+		if (error > 0) {
+			error = acquire_fallback_cred(&server->cred, url_str, allowed_types);
+
+			if (error < 0)
+				return error;
+		}
+	}
+
+	/*
+	 * No error occurred but we could not find appropriate credentials.
+	 * This behaves like a pass-through.
+	 */
+	return error;
+}
+
 static int winhttp_stream_read(
 	git_smart_subtransport_stream *stream,
 	char *buffer,
@@ -1054,7 +1102,7 @@ replay:
 
 			if (!git__prefixcmp_icase(location8, prefix_https)) {
 				/* Upgrade to secure connection; disconnect and start over */
-				if (gitno_connection_data_handle_redirect(&t->url, location8, s->service_url) < 0) {
+				if (gitno_connection_data_handle_redirect(&t->server.url, location8, s->service_url) < 0) {
 					git__free(location8);
 					return -1;
 				}
@@ -1069,67 +1117,34 @@ replay:
 			goto replay;
 		}
 
-		/* Handle proxy authentication failures */
-		if (status_code == HTTP_STATUS_PROXY_AUTH_REQ) {
-			int allowed_types;
-
-			if (parse_unauthorized_response(s->request, &allowed_types, &t->auth_mechanisms) < 0)
-				return -1;
-
-			/* TODO: extract the username from the url, no payload? */
-			if (t->owner->proxy.credentials) {
-				int cred_error = 1;
-				cred_error = t->owner->proxy.credentials(&t->proxy_cred, t->owner->proxy.url, NULL, allowed_types, t->owner->proxy.payload);
-
-				if (cred_error < 0)
-					return cred_error;
-			}
-
-			winhttp_stream_close(s);
-			goto replay;
-		}
-
 		/* Handle authentication failures */
-		if (HTTP_STATUS_DENIED == status_code && get_verb == s->verb) {
-			int allowed_types;
-
-			if (parse_unauthorized_response(s->request, &allowed_types, &t->auth_mechanisms) < 0)
-				return -1;
-
-			if (allowed_types) {
-				int cred_error = 1;
-
-				git_cred_free(t->cred);
-				t->cred = NULL;
-				/* Start with the user-supplied credential callback, if present */
-				if (t->owner->cred_acquire_cb) {
-					cred_error = t->owner->cred_acquire_cb(&t->cred, t->owner->url,
-						t->url.username, allowed_types,	t->owner->cred_acquire_payload);
-
-					/* Treat GIT_PASSTHROUGH as though git_cred_acquire_cb isn't set */
-					if (cred_error == GIT_PASSTHROUGH)
-						cred_error = 1;
-					else if (cred_error < 0)
-						return cred_error;
-				}
-
-				/* Invoke the fallback credentials acquisition callback if necessary */
-				if (cred_error > 0) {
-					cred_error = fallback_cred_acquire_cb(&t->cred, t->owner->url,
-						t->url.username, allowed_types, NULL);
-
-					if (cred_error < 0)
-						return cred_error;
-				}
-
-				if (!cred_error) {
-					assert(t->cred);
-
-					winhttp_stream_close(s);
-
-					/* Successfully acquired a credential */
-					goto replay;
-				}
+		if (status_code == HTTP_STATUS_DENIED) {
+			int error = acquire_credentials(s->request,
+				&t->server,
+				t->owner->url,
+				t->owner->cred_acquire_cb,
+				t->owner->cred_acquire_payload);
+
+			if (error < 0) {
+				return error;
+			} else if (!error) {
+				assert(t->server.cred);
+				winhttp_stream_close(s);
+				goto replay;
+			}
+		} else if (status_code == HTTP_STATUS_PROXY_AUTH_REQ) {
+			int error = acquire_credentials(s->request,
+				&t->proxy,
+				t->owner->proxy.url,
+				t->owner->proxy.credentials,
+				t->owner->proxy.payload);
+
+			if (error < 0) {
+				return error;
+			} else if (!error) {
+				assert(t->proxy.cred);
+				winhttp_stream_close(s);
+				goto replay;
 			}
 		}
 
@@ -1488,7 +1503,7 @@ static int winhttp_action(
 	int ret = -1;
 
 	if (!t->connection)
-		if ((ret = git_net_url_parse(&t->url, url)) < 0 ||
+		if ((ret = git_net_url_parse(&t->server.url, url)) < 0 ||
 			 (ret = winhttp_connect(t)) < 0)
 			return ret;
 
@@ -1530,22 +1545,17 @@ static int winhttp_close(git_smart_subtransport *subtransport)
 {
 	winhttp_subtransport *t = (winhttp_subtransport *)subtransport;
 
-	git_net_url_dispose(&t->url);
-	git_net_url_dispose(&t->proxy_url);
-
-	if (t->cred) {
-		t->cred->free(t->cred);
-		t->cred = NULL;
-	}
+	git_net_url_dispose(&t->server.url);
+	git_net_url_dispose(&t->proxy.url);
 
-	if (t->proxy_cred) {
-		t->proxy_cred->free(t->proxy_cred);
-		t->proxy_cred = NULL;
+	if (t->server.cred) {
+		t->server.cred->free(t->server.cred);
+		t->server.cred = NULL;
 	}
 
-	if (t->url_cred) {
-		t->url_cred->free(t->url_cred);
-		t->url_cred = NULL;
+	if (t->proxy.cred) {
+		t->proxy.cred->free(t->proxy.cred);
+		t->proxy.cred = NULL;
 	}
 
 	return winhttp_close_connection(t);
diff --git a/tests/online/clone.c b/tests/online/clone.c
index 68b66d018..b7042f3d6 100644
--- a/tests/online/clone.c
+++ b/tests/online/clone.c
@@ -841,3 +841,25 @@ void test_online_clone__proxy_auto_not_detected(void)
 
 	cl_git_pass(git_clone(&g_repo, "http://github.com/libgit2/TestGitRepository", "./foo", &g_options));
 }
+
+void test_online_clone__proxy_cred_callback_after_failed_url_creds(void)
+{
+	git_buf url = GIT_BUF_INIT;
+
+	if (!_remote_proxy_host || !_remote_proxy_user || !_remote_proxy_pass)
+		cl_skip();
+
+	cl_git_pass(git_buf_printf(&url, "%s://invalid_user_name:INVALID_pass_WORD@%s/",
+		_remote_proxy_scheme ? _remote_proxy_scheme : "http",
+		_remote_proxy_host));
+
+	g_options.fetch_opts.proxy_opts.type = GIT_PROXY_SPECIFIED;
+	g_options.fetch_opts.proxy_opts.url = url.ptr;
+	g_options.fetch_opts.proxy_opts.credentials = proxy_cred_cb;
+	g_options.fetch_opts.proxy_opts.certificate_check = proxy_cert_cb;
+	called_proxy_creds = 0;
+	cl_git_pass(git_clone(&g_repo, "http://github.com/libgit2/TestGitRepository", "./foo", &g_options));
+	cl_assert(called_proxy_creds);
+
+	git_buf_dispose(&url);
+}