@@ -60,7 +60,13 @@ func (s *TagStore) Pull(image string, tag string, imagePullConfig *ImagePullConf

 		return err

 	}

-	r, err := registry.NewSession(imagePullConfig.AuthConfig, registry.HTTPRequestFactory(imagePullConfig.MetaHeaders), endpoint, true)

+	// Adds Docker-specific headers as well as user-specified headers (metaHeaders)

+	tr := &registry.DockerHeaders{

+		registry.NewTransport(registry.ReceiveTimeout, endpoint.IsSecure),

+		imagePullConfig.MetaHeaders,

+	}

+	client := registry.HTTPClient(tr)

+	r, err := registry.NewSession(client, imagePullConfig.AuthConfig, endpoint)

 	if err != nil {

 		return err

 	}

@@ -109,7 +115,7 @@ func (s *TagStore) pullRepository(r *registry.Session, out io.Writer, repoInfo *

 	}

 	logrus.Debugf("Retrieving the tag list")

-	tagsList, err := r.GetRemoteTags(repoData.Endpoints, repoInfo.RemoteName, repoData.Tokens)

+	tagsList, err := r.GetRemoteTags(repoData.Endpoints, repoInfo.RemoteName)

 	if err != nil {

 		logrus.Errorf("unable to get remote tags: %s", err)

 		return err

@@ -240,7 +246,7 @@ func (s *TagStore) pullRepository(r *registry.Session, out io.Writer, repoInfo *

 }

 func (s *TagStore) pullImage(r *registry.Session, out io.Writer, imgID, endpoint string, token []string, sf *streamformatter.StreamFormatter) (bool, error) {

-	history, err := r.GetRemoteHistory(imgID, endpoint, token)

+	history, err := r.GetRemoteHistory(imgID, endpoint)

 	if err != nil {

 		return false, err

 	}

@@ -269,7 +275,7 @@ func (s *TagStore) pullImage(r *registry.Session, out io.Writer, imgID, endpoint

 			)

 			retries := 5

 			for j := 1; j <= retries; j++ {

-				imgJSON, imgSize, err = r.GetRemoteImageJSON(id, endpoint, token)

+				imgJSON, imgSize, err = r.GetRemoteImageJSON(id, endpoint)

 				if err != nil && j == retries {

 					out.Write(sf.FormatProgress(stringid.TruncateID(id), "Error pulling dependent layers", nil))

 					return layersDownloaded, err

@@ -297,7 +303,7 @@ func (s *TagStore) pullImage(r *registry.Session, out io.Writer, imgID, endpoint

 					status = fmt.Sprintf("Pulling fs layer [retries: %d]", j)

 				}

 				out.Write(sf.FormatProgress(stringid.TruncateID(id), status, nil))

-				layer, err := r.GetRemoteImageLayer(img.ID, endpoint, token, int64(imgSize))

+				layer, err := r.GetRemoteImageLayer(img.ID, endpoint, int64(imgSize))

 				if uerr, ok := err.(*url.Error); ok {

 					err = uerr.Err

 				}

@@ -141,7 +141,7 @@ func lookupImageOnEndpoint(wg *sync.WaitGroup, r *registry.Session, out io.Write

 	images chan imagePushData, imagesToPush chan string) {

 	defer wg.Done()

 	for image := range images {

-		if err := r.LookupRemoteImage(image.id, image.endpoint, image.tokens); err != nil {

+		if err := r.LookupRemoteImage(image.id, image.endpoint); err != nil {

 			logrus.Errorf("Error in LookupRemoteImage: %s", err)

 			imagesToPush <- image.id

 			continue

@@ -199,7 +199,7 @@ func (s *TagStore) pushImageToEndpoint(endpoint string, out io.Writer, remoteNam

 		}

 		for _, tag := range tags[id] {

 			out.Write(sf.FormatStatus("", "Pushing tag for rev [%s] on {%s}", stringid.TruncateID(id), endpoint+"repositories/"+remoteName+"/tags/"+tag))

-			if err := r.PushRegistryTag(remoteName, id, tag, endpoint, repo.Tokens); err != nil {

+			if err := r.PushRegistryTag(remoteName, id, tag, endpoint); err != nil {

 				return err

 			}

 		}

@@ -258,7 +258,7 @@ func (s *TagStore) pushImage(r *registry.Session, out io.Writer, imgID, ep strin

 	}

 	// Send the json

-	if err := r.PushImageJSONRegistry(imgData, jsonRaw, ep, token); err != nil {

+	if err := r.PushImageJSONRegistry(imgData, jsonRaw, ep); err != nil {

 		if err == registry.ErrAlreadyExists {

 			out.Write(sf.FormatProgress(stringid.TruncateID(imgData.ID), "Image already pushed, skipping", nil))

 			return "", nil

@@ -284,14 +284,14 @@ func (s *TagStore) pushImage(r *registry.Session, out io.Writer, imgID, ep strin

 			NewLines:  false,

 			ID:        stringid.TruncateID(imgData.ID),

 			Action:    "Pushing",

-		}), ep, token, jsonRaw)

+		}), ep, jsonRaw)

 	if err != nil {

 		return "", err

 	}

 	imgData.Checksum = checksum

 	imgData.ChecksumPayload = checksumPayload

 	// Send the checksum

-	if err := r.PushImageChecksumRegistry(imgData, ep, token); err != nil {

+	if err := r.PushImageChecksumRegistry(imgData, ep); err != nil {

 		return "", err

 	}

@@ -514,7 +514,12 @@ func (s *TagStore) Push(localName string, imagePushConfig *ImagePushConfig) erro

 		return err

 	}

-	r, err := registry.NewSession(imagePushConfig.AuthConfig, registry.HTTPRequestFactory(imagePushConfig.MetaHeaders), endpoint, false)

+	// Adds Docker-specific headers as well as user-specified headers (metaHeaders)

+	tr := &registry.DockerHeaders{

+		registry.NewTransport(registry.NoTimeout, endpoint.IsSecure),

+		imagePushConfig.MetaHeaders,

+	}

+	r, err := registry.NewSession(client, imagePushConfig.AuthConfig, endpoint)

 	if err != nil {

 		return err

 	}

@@ -47,7 +47,7 @@ func (vi *UAVersionInfo) isValid() bool {

 // "product/version", where the "product" is get from the name field, while

 // version is get from the version field. Several pieces of verson information

 // will be concatinated and separated by space.

-func appendVersions(base string, versions ...UAVersionInfo) string {

+func AppendVersions(base string, versions ...UAVersionInfo) string {

 	if len(versions) == 0 {

 		return base

 	}

@@ -87,7 +87,7 @@ func (h *UserAgentDecorator) ChangeRequest(req *http.Request) (*http.Request, er

 		return req, ErrNilRequest

 	}

-	userAgent := appendVersions(req.UserAgent(), h.Versions...)

+	userAgent := AppendVersions(req.UserAgent(), h.Versions...)

 	if len(userAgent) > 0 {

 		req.Header.Set("User-Agent", userAgent)

 	}

@@ -11,7 +11,6 @@ import (

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/docker/cliconfig"

-	"github.com/docker/docker/pkg/requestdecorator"

 )

 type RequestAuthorization struct {

@@ -46,7 +45,6 @@ func (auth *RequestAuthorization) getToken() (string, error) {

 	}

 	client := auth.registryEndpoint.HTTPClient()

-	factory := HTTPRequestFactory(nil)

 	for _, challenge := range auth.registryEndpoint.AuthChallenges {

 		switch strings.ToLower(challenge.Scheme) {

@@ -59,7 +57,7 @@ func (auth *RequestAuthorization) getToken() (string, error) {

 				params[k] = v

 			}

 			params["scope"] = fmt.Sprintf("%s:%s:%s", auth.resource, auth.scope, strings.Join(auth.actions, ","))

-			token, err := getToken(auth.authConfig.Username, auth.authConfig.Password, params, auth.registryEndpoint, client, factory)

+			token, err := getToken(auth.authConfig.Username, auth.authConfig.Password, params, auth.registryEndpoint, client)

 			if err != nil {

 				return "", err

 			}

@@ -92,16 +90,16 @@ func (auth *RequestAuthorization) Authorize(req *http.Request) error {

 }

 // Login tries to register/login to the registry server.

-func Login(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint, factory *requestdecorator.RequestFactory) (string, error) {

+func Login(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint) (string, error) {

 	// Separates the v2 registry login logic from the v1 logic.

 	if registryEndpoint.Version == APIVersion2 {

-		return loginV2(authConfig, registryEndpoint, factory)

+		return loginV2(authConfig, registryEndpoint)

 	}

-	return loginV1(authConfig, registryEndpoint, factory)

+	return loginV1(authConfig, registryEndpoint)

 }

 // loginV1 tries to register/login to the v1 registry server.

-func loginV1(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint, factory *requestdecorator.RequestFactory) (string, error) {

+func loginV1(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint) (string, error) {

 	var (

 		status        string

 		reqBody       []byte

@@ -151,7 +149,7 @@ func loginV1(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint, facto

 		}

 	} else if reqStatusCode == 400 {

 		if string(reqBody) == "\"Username or email already exists\"" {

-			req, err := factory.NewRequest("GET", serverAddress+"users/", nil)

+			req, err := http.NewRequest("GET", serverAddress+"users/", nil)

 			req.SetBasicAuth(authConfig.Username, authConfig.Password)

 			resp, err := client.Do(req)

 			if err != nil {

@@ -180,7 +178,7 @@ func loginV1(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint, facto

 	} else if reqStatusCode == 401 {

 		// This case would happen with private registries where /v1/users is

 		// protected, so people can use `docker login` as an auth check.

-		req, err := factory.NewRequest("GET", serverAddress+"users/", nil)

+		req, err := http.NewRequest("GET", serverAddress+"users/", nil)

 		req.SetBasicAuth(authConfig.Username, authConfig.Password)

 		resp, err := client.Do(req)

 		if err != nil {

@@ -214,7 +212,7 @@ func loginV1(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint, facto

 // now, users should create their account through other means like directly from a web page

 // served by the v2 registry service provider. Whether this will be supported in the future

 // is to be determined.

-func loginV2(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint, factory *requestdecorator.RequestFactory) (string, error) {

+func loginV2(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint) (string, error) {

 	logrus.Debugf("attempting v2 login to registry endpoint %s", registryEndpoint)

 	var (

 		err       error

@@ -227,9 +225,9 @@ func loginV2(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint, facto

 		switch strings.ToLower(challenge.Scheme) {

 		case "basic":

-			err = tryV2BasicAuthLogin(authConfig, challenge.Parameters, registryEndpoint, client, factory)

+			err = tryV2BasicAuthLogin(authConfig, challenge.Parameters, registryEndpoint, client)

 		case "bearer":

-			err = tryV2TokenAuthLogin(authConfig, challenge.Parameters, registryEndpoint, client, factory)

+			err = tryV2TokenAuthLogin(authConfig, challenge.Parameters, registryEndpoint, client)

 		default:

 			// Unsupported challenge types are explicitly skipped.

 			err = fmt.Errorf("unsupported auth scheme: %q", challenge.Scheme)

@@ -247,8 +245,8 @@ func loginV2(authConfig *cliconfig.AuthConfig, registryEndpoint *Endpoint, facto

 	return "", fmt.Errorf("no successful auth challenge for %s - errors: %s", registryEndpoint, allErrors)

 }

-func tryV2BasicAuthLogin(authConfig *cliconfig.AuthConfig, params map[string]string, registryEndpoint *Endpoint, client *http.Client, factory *requestdecorator.RequestFactory) error {

-	req, err := factory.NewRequest("GET", registryEndpoint.Path(""), nil)

+func tryV2BasicAuthLogin(authConfig *cliconfig.AuthConfig, params map[string]string, registryEndpoint *Endpoint, client *http.Client) error {

+	req, err := http.NewRequest("GET", registryEndpoint.Path(""), nil)

 	if err != nil {

 		return err

 	}

@@ -268,13 +266,13 @@ func tryV2BasicAuthLogin(authConfig *cliconfig.AuthConfig, params map[string]str

 	return nil

 }

-func tryV2TokenAuthLogin(authConfig *cliconfig.AuthConfig, params map[string]string, registryEndpoint *Endpoint, client *http.Client, factory *requestdecorator.RequestFactory) error {

-	token, err := getToken(authConfig.Username, authConfig.Password, params, registryEndpoint, client, factory)

+func tryV2TokenAuthLogin(authConfig *cliconfig.AuthConfig, params map[string]string, registryEndpoint *Endpoint, client *http.Client) error {

+	token, err := getToken(authConfig.Username, authConfig.Password, params, registryEndpoint, client)

 	if err != nil {

 		return err

 	}

-	req, err := factory.NewRequest("GET", registryEndpoint.Path(""), nil)

+	req, err := http.NewRequest("GET", registryEndpoint.Path(""), nil)

 	if err != nil {

 		return err

 	}

@@ -1,7 +1,6 @@

 package registry

 import (

-	"crypto/tls"

 	"encoding/json"

 	"fmt"

 	"io/ioutil"

@@ -12,7 +11,6 @@ import (

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/distribution/registry/api/v2"

-	"github.com/docker/docker/pkg/requestdecorator"

 )

 // for mocking in unit tests

@@ -109,6 +107,7 @@ func (repoInfo *RepositoryInfo) GetEndpoint() (*Endpoint, error) {

 // Endpoint stores basic information about a registry endpoint.

 type Endpoint struct {

+	client         *http.Client

 	URL            *url.URL

 	Version        APIVersion

 	IsSecure       bool

@@ -135,25 +134,24 @@ func (e *Endpoint) Path(path string) string {

 func (e *Endpoint) Ping() (RegistryInfo, error) {

 	// The ping logic to use is determined by the registry endpoint version.

-	factory := HTTPRequestFactory(nil)

 	switch e.Version {

 	case APIVersion1:

-		return e.pingV1(factory)

+		return e.pingV1()

 	case APIVersion2:

-		return e.pingV2(factory)

+		return e.pingV2()

 	}

 	// APIVersionUnknown

 	// We should try v2 first...

 	e.Version = APIVersion2

-	regInfo, errV2 := e.pingV2(factory)

+	regInfo, errV2 := e.pingV2()

 	if errV2 == nil {

 		return regInfo, nil

 	}

 	// ... then fallback to v1.

 	e.Version = APIVersion1

-	regInfo, errV1 := e.pingV1(factory)

+	regInfo, errV1 := e.pingV1()

 	if errV1 == nil {

 		return regInfo, nil

 	}

@@ -162,7 +160,7 @@ func (e *Endpoint) Ping() (RegistryInfo, error) {

 	return RegistryInfo{}, fmt.Errorf("unable to ping registry endpoint %s\nv2 ping attempt failed with error: %s\n v1 ping attempt failed with error: %s", e, errV2, errV1)

 }

-func (e *Endpoint) pingV1(factory *requestdecorator.RequestFactory) (RegistryInfo, error) {

+func (e *Endpoint) pingV1() (RegistryInfo, error) {

 	logrus.Debugf("attempting v1 ping for registry endpoint %s", e)

 	if e.String() == IndexServerAddress() {

@@ -171,12 +169,12 @@ func (e *Endpoint) pingV1(factory *requestdecorator.RequestFactory) (RegistryInf

 		return RegistryInfo{Standalone: false}, nil

 	}

-	req, err := factory.NewRequest("GET", e.Path("_ping"), nil)

+	req, err := http.NewRequest("GET", e.Path("_ping"), nil)

 	if err != nil {

 		return RegistryInfo{Standalone: false}, err

 	}

-	resp, _, err := doRequest(req, nil, ConnectTimeout, e.IsSecure)

+	resp, err := e.HTTPClient().Do(req)

 	if err != nil {

 		return RegistryInfo{Standalone: false}, err

 	}

@@ -216,15 +214,15 @@ func (e *Endpoint) pingV1(factory *requestdecorator.RequestFactory) (RegistryInf

 	return info, nil

 }

-func (e *Endpoint) pingV2(factory *requestdecorator.RequestFactory) (RegistryInfo, error) {

+func (e *Endpoint) pingV2() (RegistryInfo, error) {

 	logrus.Debugf("attempting v2 ping for registry endpoint %s", e)

-	req, err := factory.NewRequest("GET", e.Path(""), nil)

+	req, err := http.NewRequest("GET", e.Path(""), nil)

 	if err != nil {

 		return RegistryInfo{}, err

 	}

-	resp, _, err := doRequest(req, nil, ConnectTimeout, e.IsSecure)

+	resp, err := e.HTTPClient().Do(req)

 	if err != nil {

 		return RegistryInfo{}, err

 	}

@@ -265,18 +263,9 @@ HeaderLoop:

 }

 func (e *Endpoint) HTTPClient() *http.Client {

-	tlsConfig := tls.Config{

-		MinVersion: tls.VersionTLS10,

-	}

-	if !e.IsSecure {

-		tlsConfig.InsecureSkipVerify = true

-	}

-	return &http.Client{

-		Transport: &http.Transport{

-			DisableKeepAlives: true,

-			Proxy:             http.ProxyFromEnvironment,

-			TLSClientConfig:   &tlsConfig,

-		},

-		CheckRedirect: AddRequiredHeadersToRedirectedRequests,

+	if e.client == nil {

+		tr := NewTransport(ConnectTimeout, e.IsSecure)

+		e.client = HTTPClient(tr)

 	}

+	return e.client

 }

deleted file mode 100644

@@ -1,30 +0,0 @@

-package registry

-

-import (

-	"runtime"

-

-	"github.com/docker/docker/autogen/dockerversion"

-	"github.com/docker/docker/pkg/parsers/kernel"

-	"github.com/docker/docker/pkg/requestdecorator"

-)

-

-func HTTPRequestFactory(metaHeaders map[string][]string) *requestdecorator.RequestFactory {

-	// FIXME: this replicates the 'info' job.

-	httpVersion := make([]requestdecorator.UAVersionInfo, 0, 4)

-	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("docker", dockerversion.VERSION))

-	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("go", runtime.Version()))

-	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("git-commit", dockerversion.GITCOMMIT))

-	if kernelVersion, err := kernel.GetKernelVersion(); err == nil {

-		httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("kernel", kernelVersion.String()))

-	}

-	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("os", runtime.GOOS))

-	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("arch", runtime.GOARCH))

-	uad := &requestdecorator.UserAgentDecorator{

-		Versions: httpVersion,

-	}

-	mhd := &requestdecorator.MetaHeadersDecorator{

-		Headers: metaHeaders,

-	}

-	factory := requestdecorator.NewRequestFactory(uad, mhd)

-	return factory

-}

@@ -8,12 +8,17 @@ import (

 	"io/ioutil"

 	"net"

 	"net/http"

+	"net/http/httputil"

 	"os"

 	"path"

+	"runtime"

 	"strings"

 	"time"

 	"github.com/Sirupsen/logrus"

+	"github.com/docker/docker/autogen/dockerversion"

+	"github.com/docker/docker/pkg/parsers/kernel"

+	"github.com/docker/docker/pkg/requestdecorator"

 	"github.com/docker/docker/pkg/timeoutconn"

 )

@@ -31,66 +36,23 @@ const (

 	ConnectTimeout

 )

-func newClient(jar http.CookieJar, roots *x509.CertPool, certs []tls.Certificate, timeout TimeoutType, secure bool) *http.Client {

-	tlsConfig := tls.Config{

-		RootCAs: roots,

-		// Avoid fallback to SSL protocols < TLS1.0

-		MinVersion:   tls.VersionTLS10,

-		Certificates: certs,

-	}

-

-	if !secure {

-		tlsConfig.InsecureSkipVerify = true

-	}

-

-	httpTransport := &http.Transport{

-		DisableKeepAlives: true,

-		Proxy:             http.ProxyFromEnvironment,

-		TLSClientConfig:   &tlsConfig,

-	}

-

-	switch timeout {

-	case ConnectTimeout:

-		httpTransport.Dial = func(proto string, addr string) (net.Conn, error) {

-			// Set the connect timeout to 30 seconds to allow for slower connection

-			// times...

-			d := net.Dialer{Timeout: 30 * time.Second, DualStack: true}

-

-			conn, err := d.Dial(proto, addr)

-			if err != nil {

-				return nil, err

-			}

-			// Set the recv timeout to 10 seconds

-			conn.SetDeadline(time.Now().Add(10 * time.Second))

-			return conn, nil

-		}

-	case ReceiveTimeout:

-		httpTransport.Dial = func(proto string, addr string) (net.Conn, error) {

-			d := net.Dialer{DualStack: true}

-

-			conn, err := d.Dial(proto, addr)

-			if err != nil {

-				return nil, err

-			}

-			conn = timeoutconn.New(conn, 1*time.Minute)

-			return conn, nil

-		}

-	}

-

-	return &http.Client{

-		Transport:     httpTransport,

-		CheckRedirect: AddRequiredHeadersToRedirectedRequests,

-		Jar:           jar,

-	}

+type httpsTransport struct {

+	*http.Transport

 }

-func doRequest(req *http.Request, jar http.CookieJar, timeout TimeoutType, secure bool) (*http.Response, *http.Client, error) {

+// DRAGONS(tiborvass): If someone wonders why do we set tlsconfig in a roundtrip,

+// it's because it's so as to match the current behavior in master: we generate the

+// certpool on every-goddam-request. It's not great, but it allows people to just put

+// the certs in /etc/docker/certs.d/.../ and let docker "pick it up" immediately. Would

+// prefer an fsnotify implementation, but that was out of scope of my refactoring.

+// TODO: improve things

+func (tr *httpsTransport) RoundTrip(req *http.Request) (*http.Response, error) {

 	var (

-		pool  *x509.CertPool

+		roots *x509.CertPool

 		certs []tls.Certificate

 	)

-	if secure && req.URL.Scheme == "https" {

+	if req.URL.Scheme == "https" {

 		hasFile := func(files []os.FileInfo, name string) bool {

 			for _, f := range files {

 				if f.Name() == name {

@@ -104,31 +66,31 @@ func doRequest(req *http.Request, jar http.CookieJar, timeout TimeoutType, secur

 		logrus.Debugf("hostDir: %s", hostDir)

 		fs, err := ioutil.ReadDir(hostDir)

 		if err != nil && !os.IsNotExist(err) {

-			return nil, nil, err

+			return nil, err

 		}

 		for _, f := range fs {

 			if strings.HasSuffix(f.Name(), ".crt") {

-				if pool == nil {

-					pool = x509.NewCertPool()

+				if roots == nil {

+					roots = x509.NewCertPool()

 				}

 				logrus.Debugf("crt: %s", hostDir+"/"+f.Name())

 				data, err := ioutil.ReadFile(path.Join(hostDir, f.Name()))

 				if err != nil {

-					return nil, nil, err

+					return nil, err

 				}

-				pool.AppendCertsFromPEM(data)

+				roots.AppendCertsFromPEM(data)

 			}

 			if strings.HasSuffix(f.Name(), ".cert") {

 				certName := f.Name()

 				keyName := certName[:len(certName)-5] + ".key"

 				logrus.Debugf("cert: %s", hostDir+"/"+f.Name())

 				if !hasFile(fs, keyName) {

-					return nil, nil, fmt.Errorf("Missing key %s for certificate %s", keyName, certName)

+					return nil, fmt.Errorf("Missing key %s for certificate %s", keyName, certName)

 				}

 				cert, err := tls.LoadX509KeyPair(path.Join(hostDir, certName), path.Join(hostDir, keyName))

 				if err != nil {

-					return nil, nil, err

+					return nil, err

 				}

 				certs = append(certs, cert)

 			}

@@ -137,24 +99,142 @@ func doRequest(req *http.Request, jar http.CookieJar, timeout TimeoutType, secur

 				certName := keyName[:len(keyName)-4] + ".cert"

 				logrus.Debugf("key: %s", hostDir+"/"+f.Name())

 				if !hasFile(fs, certName) {

-					return nil, nil, fmt.Errorf("Missing certificate %s for key %s", certName, keyName)

+					return nil, fmt.Errorf("Missing certificate %s for key %s", certName, keyName)

 				}

 			}

 		}

+		if tr.Transport.TLSClientConfig == nil {

+			tr.Transport.TLSClientConfig = &tls.Config{

+				// Avoid fallback to SSL protocols < TLS1.0

+				MinVersion: tls.VersionTLS10,

+			}

+		}

+		tr.Transport.TLSClientConfig.RootCAs = roots

+		tr.Transport.TLSClientConfig.Certificates = certs

+	}

+	return tr.Transport.RoundTrip(req)

+}

+

+func NewTransport(timeout TimeoutType, secure bool) http.RoundTripper {

+	tlsConfig := tls.Config{

+		// Avoid fallback to SSL protocols < TLS1.0

+		MinVersion:         tls.VersionTLS10,

+		InsecureSkipVerify: !secure,

+	}

+

+	transport := &http.Transport{

+		DisableKeepAlives: true,

+		Proxy:             http.ProxyFromEnvironment,

+		TLSClientConfig:   &tlsConfig,

 	}

-	if len(certs) == 0 {

-		client := newClient(jar, pool, nil, timeout, secure)

-		res, err := client.Do(req)

-		if err != nil {

-			return nil, nil, err

+	switch timeout {

+	case ConnectTimeout:

+		transport.Dial = func(proto string, addr string) (net.Conn, error) {

+			// Set the connect timeout to 30 seconds to allow for slower connection

+			// times...

+			d := net.Dialer{Timeout: 30 * time.Second, DualStack: true}

+

+			conn, err := d.Dial(proto, addr)

+			if err != nil {

+				return nil, err

+			}

+			// Set the recv timeout to 10 seconds

+			conn.SetDeadline(time.Now().Add(10 * time.Second))

+			return conn, nil

+		}

+	case ReceiveTimeout:

+		transport.Dial = func(proto string, addr string) (net.Conn, error) {

+			d := net.Dialer{DualStack: true}

+

+			conn, err := d.Dial(proto, addr)

+			if err != nil {

+				return nil, err

+			}

+			conn = timeoutconn.New(conn, 1*time.Minute)

+			return conn, nil

 		}

-		return res, client, nil

 	}

-	client := newClient(jar, pool, certs, timeout, secure)

-	res, err := client.Do(req)

-	return res, client, err

+	if secure {

+		// note: httpsTransport also handles http transport

+		// but for HTTPS, it sets up the certs

+		return &httpsTransport{transport}

+	}

+

+	return transport

+}

+

+type DockerHeaders struct {

+	http.RoundTripper

+	Headers http.Header

+}

+

+// cloneRequest returns a clone of the provided *http.Request.

+// The clone is a shallow copy of the struct and its Header map

+func cloneRequest(r *http.Request) *http.Request {

+	// shallow copy of the struct

+	r2 := new(http.Request)

+	*r2 = *r

+	// deep copy of the Header

+	r2.Header = make(http.Header, len(r.Header))

+	for k, s := range r.Header {

+		r2.Header[k] = append([]string(nil), s...)

+	}

+	return r2

+}

+

+func (tr *DockerHeaders) RoundTrip(req *http.Request) (*http.Response, error) {

+	req = cloneRequest(req)

+	httpVersion := make([]requestdecorator.UAVersionInfo, 0, 4)

+	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("docker", dockerversion.VERSION))

+	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("go", runtime.Version()))

+	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("git-commit", dockerversion.GITCOMMIT))

+	if kernelVersion, err := kernel.GetKernelVersion(); err == nil {

+		httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("kernel", kernelVersion.String()))

+	}

+	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("os", runtime.GOOS))

+	httpVersion = append(httpVersion, requestdecorator.NewUAVersionInfo("arch", runtime.GOARCH))

+

+	userAgent := requestdecorator.AppendVersions(req.UserAgent(), httpVersion...)

+

+	req.Header.Set("User-Agent", userAgent)

+

+	for k, v := range tr.Headers {

+		req.Header[k] = v

+	}

+	return tr.RoundTripper.RoundTrip(req)

+}

+

+type debugTransport struct{ http.RoundTripper }

+

+func (tr debugTransport) RoundTrip(req *http.Request) (*http.Response, error) {

+	dump, err := httputil.DumpRequestOut(req, false)

+	if err != nil {

+		fmt.Println("could not dump request")

+	}

+	fmt.Println(string(dump))

+	resp, err := tr.RoundTripper.RoundTrip(req)

+	if err != nil {

+		return nil, err

+	}

+	dump, err = httputil.DumpResponse(resp, false)

+	if err != nil {

+		fmt.Println("could not dump response")

+	}

+	fmt.Println(string(dump))

+	return resp, err

+}

+

+func HTTPClient(transport http.RoundTripper) *http.Client {

+	if transport == nil {

+		transport = NewTransport(ConnectTimeout, true)

+	}

+

+	return &http.Client{

+		Transport:     transport,

+		CheckRedirect: AddRequiredHeadersToRedirectedRequests,

+	}

 }

 func trustedLocation(req *http.Request) bool {

@@ -8,7 +8,6 @@ import (

 	"testing"

 	"github.com/docker/docker/cliconfig"

-	"github.com/docker/docker/pkg/requestdecorator"

 )

 var (

@@ -26,38 +25,27 @@ func spawnTestRegistrySession(t *testing.T) *Session {

 	if err != nil {

 		t.Fatal(err)

 	}

-	r, err := NewSession(authConfig, requestdecorator.NewRequestFactory(), endpoint, true)

+	var tr http.RoundTripper = debugTransport{NewTransport(ReceiveTimeout, endpoint.IsSecure)}

+	tr = &DockerHeaders{&authTransport{RoundTripper: tr, AuthConfig: authConfig}, nil}

+	client := HTTPClient(tr)

+	r, err := NewSession(client, authConfig, endpoint)

 	if err != nil {

 		t.Fatal(err)

 	}

+	// In a normal scenario for the v1 registry, the client should send a `X-Docker-Token: true`

+	// header while authenticating, in order to retrieve a token that can be later used to

+	// perform authenticated actions.

+	//

+	// The mock v1 registry does not support that, (TODO(tiborvass): support it), instead,

+	// it will consider authenticated any request with the header `X-Docker-Token: fake-token`.

+	//

+	// Because we know that the client's transport is an `*authTransport` we simply cast it,

+	// in order to set the internal cached token to the fake token, and thus send that fake token

+	// upon every subsequent requests.

+	r.client.Transport.(*authTransport).token = token

 	return r

 }

-func TestPublicSession(t *testing.T) {

-	authConfig := &cliconfig.AuthConfig{}

-

-	getSessionDecorators := func(index *IndexInfo) int {

-		endpoint, err := NewEndpoint(index)

-		if err != nil {

-			t.Fatal(err)

-		}

-		r, err := NewSession(authConfig, requestdecorator.NewRequestFactory(), endpoint, true)

-		if err != nil {

-			t.Fatal(err)

-		}

-		return len(r.reqFactory.GetDecorators())

-	}

-

-	decorators := getSessionDecorators(makeIndex("/v1/"))

-	assertEqual(t, decorators, 0, "Expected no decorator on http session")

-

-	decorators = getSessionDecorators(makeHttpsIndex("/v1/"))

-	assertNotEqual(t, decorators, 0, "Expected decorator on https session")

-

-	decorators = getSessionDecorators(makePublicIndex())

-	assertEqual(t, decorators, 0, "Expected no decorator on public session")

-}

-

 func TestPingRegistryEndpoint(t *testing.T) {

 	testPing := func(index *IndexInfo, expectedStandalone bool, assertMessage string) {

 		ep, err := NewEndpoint(index)

@@ -170,7 +158,7 @@ func TestEndpoint(t *testing.T) {

 func TestGetRemoteHistory(t *testing.T) {

 	r := spawnTestRegistrySession(t)

-	hist, err := r.GetRemoteHistory(imageID, makeURL("/v1/"), token)

+	hist, err := r.GetRemoteHistory(imageID, makeURL("/v1/"))

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -182,16 +170,16 @@ func TestGetRemoteHistory(t *testing.T) {

 func TestLookupRemoteImage(t *testing.T) {

 	r := spawnTestRegistrySession(t)

-	err := r.LookupRemoteImage(imageID, makeURL("/v1/"), token)

+	err := r.LookupRemoteImage(imageID, makeURL("/v1/"))

 	assertEqual(t, err, nil, "Expected error of remote lookup to nil")

-	if err := r.LookupRemoteImage("abcdef", makeURL("/v1/"), token); err == nil {

+	if err := r.LookupRemoteImage("abcdef", makeURL("/v1/")); err == nil {

 		t.Fatal("Expected error of remote lookup to not nil")

 	}

 }

 func TestGetRemoteImageJSON(t *testing.T) {

 	r := spawnTestRegistrySession(t)

-	json, size, err := r.GetRemoteImageJSON(imageID, makeURL("/v1/"), token)

+	json, size, err := r.GetRemoteImageJSON(imageID, makeURL("/v1/"))

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -200,7 +188,7 @@ func TestGetRemoteImageJSON(t *testing.T) {

 		t.Fatal("Expected non-empty json")

 	}

-	_, _, err = r.GetRemoteImageJSON("abcdef", makeURL("/v1/"), token)

+	_, _, err = r.GetRemoteImageJSON("abcdef", makeURL("/v1/"))

 	if err == nil {

 		t.Fatal("Expected image not found error")

 	}

@@ -208,7 +196,7 @@ func TestGetRemoteImageJSON(t *testing.T) {

 func TestGetRemoteImageLayer(t *testing.T) {

 	r := spawnTestRegistrySession(t)

-	data, err := r.GetRemoteImageLayer(imageID, makeURL("/v1/"), token, 0)

+	data, err := r.GetRemoteImageLayer(imageID, makeURL("/v1/"), 0)

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -216,7 +204,7 @@ func TestGetRemoteImageLayer(t *testing.T) {

 		t.Fatal("Expected non-nil data result")

 	}

-	_, err = r.GetRemoteImageLayer("abcdef", makeURL("/v1/"), token, 0)

+	_, err = r.GetRemoteImageLayer("abcdef", makeURL("/v1/"), 0)

 	if err == nil {

 		t.Fatal("Expected image not found error")

 	}

@@ -224,14 +212,14 @@ func TestGetRemoteImageLayer(t *testing.T) {

 func TestGetRemoteTags(t *testing.T) {

 	r := spawnTestRegistrySession(t)

-	tags, err := r.GetRemoteTags([]string{makeURL("/v1/")}, REPO, token)

+	tags, err := r.GetRemoteTags([]string{makeURL("/v1/")}, REPO)

 	if err != nil {

 		t.Fatal(err)

 	}

 	assertEqual(t, len(tags), 1, "Expected one tag")

 	assertEqual(t, tags["latest"], imageID, "Expected tag latest to map to "+imageID)

-	_, err = r.GetRemoteTags([]string{makeURL("/v1/")}, "foo42/baz", token)

+	_, err = r.GetRemoteTags([]string{makeURL("/v1/")}, "foo42/baz")

 	if err == nil {

 		t.Fatal("Expected error when fetching tags for bogus repo")

 	}

@@ -265,7 +253,7 @@ func TestPushImageJSONRegistry(t *testing.T) {

 		Checksum: "sha256:1ac330d56e05eef6d438586545ceff7550d3bdcb6b19961f12c5ba714ee1bb37",

 	}

-	err := r.PushImageJSONRegistry(imgData, []byte{0x42, 0xdf, 0x0}, makeURL("/v1/"), token)

+	err := r.PushImageJSONRegistry(imgData, []byte{0x42, 0xdf, 0x0}, makeURL("/v1/"))

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -274,7 +262,7 @@ func TestPushImageJSONRegistry(t *testing.T) {

 func TestPushImageLayerRegistry(t *testing.T) {

 	r := spawnTestRegistrySession(t)

 	layer := strings.NewReader("")

-	_, _, err := r.PushImageLayerRegistry(imageID, layer, makeURL("/v1/"), token, []byte{})

+	_, _, err := r.PushImageLayerRegistry(imageID, layer, makeURL("/v1/"), []byte{})

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -694,7 +682,7 @@ func TestNewIndexInfo(t *testing.T) {

 func TestPushRegistryTag(t *testing.T) {

 	r := spawnTestRegistrySession(t)

-	err := r.PushRegistryTag("foo42/bar", imageID, "stable", makeURL("/v1/"), token)

+	err := r.PushRegistryTag("foo42/bar", imageID, "stable", makeURL("/v1/"))

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -32,7 +32,7 @@ func (s *Service) Auth(authConfig *cliconfig.AuthConfig) (string, error) {

 		return "", err

 	}

 	authConfig.ServerAddress = endpoint.String()

-	return Login(authConfig, endpoint, HTTPRequestFactory(nil))

+	return Login(authConfig, endpoint)

 }

 // Search queries the public registry for images matching the specified

@@ -42,12 +42,13 @@ func (s *Service) Search(term string, authConfig *cliconfig.AuthConfig, headers

 	if err != nil {

 		return nil, err

 	}

+

 	// *TODO: Search multiple indexes.

 	endpoint, err := repoInfo.GetEndpoint()

 	if err != nil {

 		return nil, err

 	}

-	r, err := NewSession(authConfig, HTTPRequestFactory(headers), endpoint, true)

+	r, err := NewSession(endpoint.HTTPClient(), authConfig, endpoint)

 	if err != nil {

 		return nil, err

 	}

@@ -3,6 +3,7 @@ package registry

 import (

 	"bytes"

 	"crypto/sha256"

+	"errors"

 	// this is required for some certificates

 	_ "crypto/sha512"

 	"encoding/hex"

@@ -20,64 +21,105 @@ import (

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/docker/cliconfig"

 	"github.com/docker/docker/pkg/httputils"

-	"github.com/docker/docker/pkg/requestdecorator"

 	"github.com/docker/docker/pkg/tarsum"

 )

 type Session struct {

-	authConfig    *cliconfig.AuthConfig