Merge branch 'master' into 596-int

47 files changed, 628 insertions, 326 deletions

diff --git a/.travis.yml b/.travis.yml
index a9a04c89..45fb1722 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,4 +1,5 @@
 language: python
+sudo: false
 python:
   - "2.6"
   - "2.7"
@@ -12,8 +13,8 @@ install:
   - pip install coveralls # For coveralls.io specifically
   - pip install -r dev-requirements.txt
 script:
-  # Main tests, with coverage!
-  - inv test --coverage
+  # Main tests, w/ coverage! (but skip coverage on 3.2, coverage.py dropped it)
+  - "[[ $TRAVIS_PYTHON_VERSION != 3.2 ]] && inv test --coverage || inv test"
   # Ensure documentation & invoke pipeline run OK.
   # Run 'docs' first since its objects.inv is referred to by 'www'.
   # Also force warnings to be errors since most of them tend to be actual
diff --git a/README b/README
index b5ccb697..57512604 100644
--- a/README
+++ b/README
@@ -5,7 +5,7 @@ paramiko
 
 :Paramiko: Python SSH module
 :Copyright: Copyright (c) 2003-2009  Robey Pointer <robeypointer@gmail.com>
-:Copyright: Copyright (c) 2013-2014  Jeff Forcier <jeff@bitprophet.org>
+:Copyright: Copyright (c) 2013-2015  Jeff Forcier <jeff@bitprophet.org>
 :License: LGPL
 :Homepage: https://github.com/paramiko/paramiko/
 :API docs: http://docs.paramiko.org
diff --git a/demos/demo_server.py b/demos/demo_server.py
index 5b3d5164..c4af9b10 100644
--- a/demos/demo_server.py
+++ b/demos/demo_server.py
@@ -159,7 +159,7 @@ try:
     print('Authenticated!')
 
     server.event.wait(10)
-    if not server.event.isSet():
+    if not server.event.is_set():
         print('*** Client never asked for a shell.')
         sys.exit(1)
 
diff --git a/dev-requirements.txt b/dev-requirements.txt
index 7a0ccbc5..059572cf 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -1,9 +1,11 @@
 # Older junk
 tox>=1.4,<1.5
 # For newer tasks like building Sphinx docs.
-invoke>=0.7.0,<0.8
-invocations>=0.5.0
+invoke>=0.10
+invocations>=0.9.2
 sphinx>=1.1.3
 alabaster>=0.6.1
 releases>=0.5.2
-wheel==0.23.0
+semantic_version>=2.4,<2.5
+wheel==0.24
+twine==1.5
diff --git a/paramiko/_version.py b/paramiko/_version.py
index d9f78740..e82b8667 100644
--- a/paramiko/_version.py
+++ b/paramiko/_version.py
@@ -1,2 +1,2 @@
-__version_info__ = (1, 15, 1)
+__version_info__ = (1, 16, 0)
 __version__ = '.'.join(map(str, __version_info__))
diff --git a/paramiko/_winapi.py b/paramiko/_winapi.py
index 0d55d291..cf4d68e5 100644
--- a/paramiko/_winapi.py
+++ b/paramiko/_winapi.py
@@ -106,7 +106,7 @@ MapViewOfFile.restype = ctypes.wintypes.HANDLE
 
 class MemoryMap(object):
     """
-    A memory map object which can have security attributes overrideden.
+    A memory map object which can have security attributes overridden.
     """
     def __init__(self, name, length, security_attributes=None):
         self.name = name
@@ -213,12 +213,14 @@ class SECURITY_ATTRIBUTES(ctypes.Structure):
         super(SECURITY_ATTRIBUTES, self).__init__(*args, **kwargs)
         self.nLength = ctypes.sizeof(SECURITY_ATTRIBUTES)
 
-    def _get_descriptor(self):
+    @property
+    def descriptor(self):
         return self._descriptor
-    def _set_descriptor(self, descriptor):
-        self._descriptor = descriptor
-        self.lpSecurityDescriptor = ctypes.addressof(descriptor)
-    descriptor = property(_get_descriptor, _set_descriptor)
+
+    @descriptor.setter
+    def descriptor(self, value):
+        self._descriptor = value
+        self.lpSecurityDescriptor = ctypes.addressof(value)
 
 def GetTokenInformation(token, information_class):
     """
diff --git a/paramiko/agent.py b/paramiko/agent.py
index 4f463449..6a8e7fb4 100644
--- a/paramiko/agent.py
+++ b/paramiko/agent.py
@@ -32,7 +32,7 @@ from select import select
 from paramiko.common import asbytes, io_sleep
 from paramiko.py3compat import byte_chr
 
-from paramiko.ssh_exception import SSHException
+from paramiko.ssh_exception import SSHException, AuthenticationException
 from paramiko.message import Message
 from paramiko.pkey import PKey
 from paramiko.util import retry_on_signal
@@ -73,7 +73,8 @@ class AgentSSH(object):
         self._keys = tuple(keys)
 
     def _close(self):
-        #self._conn.close()
+        if self._conn is not None:
+            self._conn.close()
         self._conn = None
         self._keys = ()
 
@@ -108,9 +109,12 @@ class AgentProxyThread(threading.Thread):
     def run(self):
         try:
             (r, addr) = self.get_connection()
+            # Found that r should be either a socket from the socket library or None
             self.__inr = r
-            self.__addr = addr
+            self.__addr = addr # This should be an IP address as a string? or None
             self._agent.connect()
+            if not isinstance(self._agent, int) and (self._agent._conn is None or not hasattr(self._agent._conn, 'fileno')):
+                raise AuthenticationException("Unable to connect to SSH agent")
             self._communicate()
         except:
             #XXX Not sure what to do here ... raise or pass ?
@@ -286,6 +290,26 @@ class AgentServerProxy(AgentSSH):
 
 
 class AgentRequestHandler(object):
+    """
+    Primary/default implementation of SSH agent forwarding functionality.
+
+    Simply instantiate this class, handing it a live command-executing session
+    object, and it will handle forwarding any local SSH agent processes it
+    finds.
+
+    For example::
+
+        # Connect
+        client = SSHClient()
+        client.connect(host, port, username)
+        # Obtain session
+        session = client.get_transport().open_session()
+        # Forward local agent
+        AgentRequestHandler(session)
+        # Commands executed after this point will see the forwarded agent on
+        # the remote end.
+        session.exec_command("git clone https://my.git.repository/")
+    """
     def __init__(self, chanClient):
         self._conn = None
         self.__chanC = chanClient
diff --git a/paramiko/auth_handler.py b/paramiko/auth_handler.py
index b5fea654..ef4a8c7e 100644
--- a/paramiko/auth_handler.py
+++ b/paramiko/auth_handler.py
@@ -34,7 +34,7 @@ from paramiko.common import cMSG_SERVICE_REQUEST, cMSG_DISCONNECT, \
     cMSG_USERAUTH_GSSAPI_ERRTOK, cMSG_USERAUTH_GSSAPI_MIC,\
     MSG_USERAUTH_GSSAPI_RESPONSE, MSG_USERAUTH_GSSAPI_TOKEN, \
     MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, MSG_USERAUTH_GSSAPI_ERROR, \
-    MSG_USERAUTH_GSSAPI_ERRTOK, MSG_USERAUTH_GSSAPI_MIC
+    MSG_USERAUTH_GSSAPI_ERRTOK, MSG_USERAUTH_GSSAPI_MIC, MSG_NAMES
 
 from paramiko.message import Message
 from paramiko.py3compat import bytestring
@@ -195,7 +195,7 @@ class AuthHandler (object):
                 if (e is None) or issubclass(e.__class__, EOFError):
                     e = AuthenticationException('Authentication failed.')
                 raise e
-            if event.isSet():
+            if event.is_set():
                 break
         if not self.is_authenticated():
             e = self.transport.get_exception()
@@ -510,15 +510,11 @@ class AuthHandler (object):
                 result = AUTH_FAILED
                 self._send_auth_result(username, method, result)
                 raise
-            if retval == 0:
-                # TODO: Implement client credential saving.
-                # The OpenSSH server is able to create a TGT with the delegated
-                # client credentials, but this is not supported by GSS-API.
-                result = AUTH_SUCCESSFUL
-                self.transport.server_object.check_auth_gssapi_with_mic(
-                    username, result)
-            else:
-                result = AUTH_FAILED
+            # TODO: Implement client credential saving.
+            # The OpenSSH server is able to create a TGT with the delegated
+            # client credentials, but this is not supported by GSS-API.
+            result = AUTH_SUCCESSFUL
+            self.transport.server_object.check_auth_gssapi_with_mic(username, result)
         elif method == "gssapi-keyex" and gss_auth:
             mic_token = m.get_string()
             sshgss = self.transport.kexgss_ctxt
@@ -534,12 +530,8 @@ class AuthHandler (object):
                 result = AUTH_FAILED
                 self._send_auth_result(username, method, result)
                 raise
-            if retval == 0:
-                result = AUTH_SUCCESSFUL
-                self.transport.server_object.check_auth_gssapi_keyex(username,
-                                                                      result)
-            else:
-                result = AUTH_FAILED
+            result = AUTH_SUCCESSFUL
+            self.transport.server_object.check_auth_gssapi_keyex(username, result)
         else:
             result = self.transport.server_object.check_auth_none(username)
         # okay, send result
diff --git a/paramiko/ber.py b/paramiko/ber.py
index 05152303..a388df07 100644
--- a/paramiko/ber.py
+++ b/paramiko/ber.py
@@ -45,7 +45,7 @@ class BER(object):
 
     def decode(self):
         return self.decode_next()
-    
+
     def decode_next(self):
         if self.idx >= len(self.content):
             return None
@@ -89,6 +89,7 @@ class BER(object):
             # 1: boolean (00 false, otherwise true)
             raise BERException('Unknown ber encoding type %d (robey is lazy)' % ident)
 
+    @staticmethod
     def decode_sequence(data):
         out = []
         ber = BER(data)
@@ -98,7 +99,6 @@ class BER(object):
                 break
             out.append(x)
         return out
-    decode_sequence = staticmethod(decode_sequence)
 
     def encode_tlv(self, ident, val):
         # no need to support ident > 31 here
@@ -125,9 +125,9 @@ class BER(object):
         else:
             raise BERException('Unknown type for encoding: %s' % repr(type(x)))
 
+    @staticmethod
     def encode_sequence(data):
         ber = BER()
         for item in data:
             ber.encode(item)
         return ber.asbytes()
-    encode_sequence = staticmethod(encode_sequence)
diff --git a/paramiko/channel.py b/paramiko/channel.py
index 9de278cb..7e39a15b 100644
--- a/paramiko/channel.py
+++ b/paramiko/channel.py
@@ -290,7 +290,7 @@ class Channel (ClosingContextManager):
 
         .. versionadded:: 1.7.3
         """
-        return self.closed or self.status_event.isSet()
+        return self.closed or self.status_event.is_set()
 
     def recv_exit_status(self):
         """
@@ -305,7 +305,7 @@ class Channel (ClosingContextManager):
         .. versionadded:: 1.2
         """
         self.status_event.wait()
-        assert self.status_event.isSet()
+        assert self.status_event.is_set()
         return self.exit_status
 
     def send_exit_status(self, status):
@@ -337,7 +337,7 @@ class Channel (ClosingContextManager):
         further x11 requests can be made from the server to the client,
         when an x11 application is run in a shell session.
 
-        From RFC4254::
+        From :rfc:`4254`::
 
             It is RECOMMENDED that the 'x11 authentication cookie' that is
             sent be a fake, random cookie, and that the cookie be checked and
@@ -890,7 +890,7 @@ class Channel (ClosingContextManager):
         self.out_max_packet_size = self.transport. \
             _sanitize_packet_size(max_packet_size)
         self.active = 1
-        self._log(DEBUG, 'Max packet out: %d bytes' % max_packet_size)
+        self._log(DEBUG, 'Max packet out: %d bytes' % self.out_max_packet_size)
 
     def _request_success(self, m):
         self._log(DEBUG, 'Sesch channel %d request ok' % self.chanid)
@@ -1077,7 +1077,7 @@ class Channel (ClosingContextManager):
 
     def _wait_for_event(self):
         self.event.wait()
-        assert self.event.isSet()
+        assert self.event.is_set()
         if self.event_ready:
             return
         e = self.transport.get_exception()
diff --git a/paramiko/client.py b/paramiko/client.py
index 393e3e09..5a215a81 100644
--- a/paramiko/client.py
+++ b/paramiko/client.py
@@ -25,6 +25,7 @@ import getpass
 import os
 import socket
 import warnings
+from errno import ECONNREFUSED, EHOSTUNREACH
 
 from paramiko.agent import Agent
 from paramiko.common import DEBUG
@@ -35,7 +36,9 @@ from paramiko.hostkeys import HostKeys
 from paramiko.py3compat import string_types
 from paramiko.resource import ResourceManager
 from paramiko.rsakey import RSAKey
-from paramiko.ssh_exception import SSHException, BadHostKeyException
+from paramiko.ssh_exception import (
+    SSHException, BadHostKeyException, NoValidConnectionsError
+)
 from paramiko.transport import Transport
 from paramiko.util import retry_on_signal, ClosingContextManager
 
@@ -172,10 +175,46 @@ class SSHClient (ClosingContextManager):
         """
         self._policy = policy
 
-    def connect(self, hostname, port=SSH_PORT, username=None, password=None, pkey=None,
-                key_filename=None, timeout=None, allow_agent=True, look_for_keys=True,
-                compress=False, sock=None, gss_auth=False, gss_kex=False,
-                gss_deleg_creds=True, gss_host=None, banner_timeout=None):
+    def _families_and_addresses(self, hostname, port):
+        """
+        Yield pairs of address families and addresses to try for connecting.
+
+        :param str hostname: the server to connect to
+        :param int port: the server port to connect to
+        :returns: Yields an iterable of ``(family, address)`` tuples
+        """
+        guess = True
+        addrinfos = socket.getaddrinfo(hostname, port, socket.AF_UNSPEC, socket.SOCK_STREAM)
+        for (family, socktype, proto, canonname, sockaddr) in addrinfos:
+            if socktype == socket.SOCK_STREAM:
+                yield family, sockaddr
+                guess = False
+
+        # some OS like AIX don't indicate SOCK_STREAM support, so just guess. :(
+        # We only do this if we did not get a single result marked as socktype == SOCK_STREAM.
+        if guess:
+            for family, _, _, _, sockaddr in addrinfos:
+                yield family, sockaddr
+
+    def connect(
+        self,
+        hostname,
+        port=SSH_PORT,
+        username=None,
+        password=None,
+        pkey=None,
+        key_filename=None,
+        timeout=None,
+        allow_agent=True,
+        look_for_keys=True,
+        compress=False,
+        sock=None,
+        gss_auth=False,
+        gss_kex=False,
+        gss_deleg_creds=True,
+        gss_host=None,
+        banner_timeout=None
+    ):
         """
         Connect to an SSH server and authenticate to it.  The server's host key
         is checked against the system host keys (see `load_system_host_keys`)
@@ -206,8 +245,10 @@ class SSHClient (ClosingContextManager):
         :param str key_filename:
             the filename, or list of filenames, of optional private key(s) to
             try for authentication
-        :param float timeout: an optional timeout (in seconds) for the TCP connect
-        :param bool allow_agent: set to False to disable connecting to the SSH agent
+        :param float timeout:
+            an optional timeout (in seconds) for the TCP connect
+        :param bool allow_agent:
+            set to False to disable connecting to the SSH agent
         :param bool look_for_keys:
             set to False to disable searching for discoverable private key
             files in ``~/.ssh/``
@@ -216,9 +257,11 @@ class SSHClient (ClosingContextManager):
             an open socket or socket-like object (such as a `.Channel`) to use
             for communication to the target host
         :param bool gss_auth: ``True`` if you want to use GSS-API authentication
-        :param bool gss_kex: Perform GSS-API Key Exchange and user authentication
+        :param bool gss_kex:
+            Perform GSS-API Key Exchange and user authentication
         :param bool gss_deleg_creds: Delegate GSS-API client credentials or not
-        :param str gss_host: The targets name in the kerberos database. default: hostname
+        :param str gss_host:
+            The targets name in the kerberos database. default: hostname
         :param float banner_timeout: an optional timeout (in seconds) to wait
             for the SSH banner to be presented.
 
@@ -234,21 +277,37 @@ class SSHClient (ClosingContextManager):
             ``gss_deleg_creds`` and ``gss_host`` arguments.
         """
         if not sock:
-            for (family, socktype, proto, canonname, sockaddr) in socket.getaddrinfo(hostname, port, socket.AF_UNSPEC, socket.SOCK_STREAM):
-                if socktype == socket.SOCK_STREAM:
-                    af = family
-                    addr = sockaddr
-                    break
-            else:
-                # some OS like AIX don't indicate SOCK_STREAM support, so just guess. :(
-                af, _, _, _, addr = socket.getaddrinfo(hostname, port, socket.AF_UNSPEC, socket.SOCK_STREAM)
-            sock = socket.socket(af, socket.SOCK_STREAM)
-            if timeout is not None:
+            errors = {}
+            # Try multiple possible address families (e.g. IPv4 vs IPv6)
+            to_try = list(self._families_and_addresses(hostname, port))
+            for af, addr in to_try:
                 try:
-                    sock.settimeout(timeout)
-                except:
-                    pass
-            retry_on_signal(lambda: sock.connect(addr))
+                    sock = socket.socket(af, socket.SOCK_STREAM)
+                    if timeout is not None:
+                        try:
+                            sock.settimeout(timeout)
+                        except:
+                            pass
+                    retry_on_signal(lambda: sock.connect(addr))
+                    # Break out of the loop on success
+                    break
+                except socket.error as e:
+                    # Raise anything that isn't a straight up connection error
+                    # (such as a resolution error)
+                    if e.errno not in (ECONNREFUSED, EHOSTUNREACH):
+                        raise
+                    # Capture anything else so we know how the run looks once
+                    # iteration is complete. Retain info about which attempt
+                    # this was.
+                    errors[addr] = e
+
+            # Make sure we explode usefully if no address family attempts
+            # succeeded. We've no way of knowing which error is the "right"
+            # one, so we construct a hybrid exception containing all the real
+            # ones, of a subclass that client code should still be watching for
+            # (socket.error)
+            if len(errors) == len(to_try):
+                raise NoValidConnectionsError(errors)
 
         t = self._transport = Transport(sock, gss_kex=gss_kex, gss_deleg_creds=gss_deleg_creds)
         t.use_compression(compress=compress)
@@ -338,7 +397,7 @@ class SSHClient (ClosingContextManager):
 
         :raises SSHException: if the server fails to execute the command
         """
-        chan = self._transport.open_session()
+        chan = self._transport.open_session(timeout=timeout)
         if get_pty:
             chan.get_pty()
         chan.settimeout(timeout)
diff --git a/paramiko/common.py b/paramiko/common.py
index 97b2f958..0b0cc2a7 100644
--- a/paramiko/common.py
+++ b/paramiko/common.py
@@ -195,7 +195,11 @@ DEFAULT_MAX_PACKET_SIZE = 2 ** 15
 # lower bound on the max packet size we'll accept from the remote host
 # Minimum packet size is 32768 bytes according to
 # http://www.ietf.org/rfc/rfc4254.txt
-MIN_PACKET_SIZE = 2 ** 15
+MIN_WINDOW_SIZE = 2 ** 15
+
+# However, according to http://www.ietf.org/rfc/rfc4253.txt it is perfectly
+# legal to accept a size much smaller, as OpenSSH client does as size 16384.
+MIN_PACKET_SIZE = 2 ** 12
 
 # Max windows size according to http://www.ietf.org/rfc/rfc4254.txt
 MAX_WINDOW_SIZE = 2**32 -1
diff --git a/paramiko/config.py b/paramiko/config.py
index 85fdddd3..233a87d9 100644
--- a/paramiko/config.py
+++ b/paramiko/config.py
@@ -24,6 +24,7 @@ Configuration file (aka ``ssh_config``) support.
 import fnmatch
 import os
 import re
+import shlex
 import socket
 
 SSH_PORT = 22
@@ -54,7 +55,6 @@ class SSHConfig (object):
 
         :param file file_obj: a file-like object to read the config file from
         """
-
         host = {"host": ['*'], "config": {}}
         for line in file_obj:
             line = line.rstrip('\r\n').lstrip()
@@ -73,6 +73,9 @@ class SSHConfig (object):
                     'host': self._get_hosts(value),
                     'config': {}
                 }
+            elif key == 'proxycommand' and value.lower() == 'none':
+                # Proxycommands of none should not be added as an actual value. (Issue #415)
+                continue
             else:
                 if value.startswith('"') and value.endswith('"'):
                     value = value[1:-1]
@@ -222,25 +225,10 @@ class SSHConfig (object):
         """
         Return a list of host_names from host value.
         """
-        i, length = 0, len(host)
-        hosts = []
-        while i < length:
-            if host[i] == '"':
-                end = host.find('"', i + 1)
-                if end < 0:
-                    raise Exception("Unparsable host %s" % host)
-                hosts.append(host[i + 1:end])
-                i = end + 1
-            elif not host[i].isspace():
-                end = i + 1
-                while end < length and not host[end].isspace() and host[end] != '"':
-                    end += 1
-                hosts.append(host[i:end])
-                i = end
-            else:
-                i += 1
-
-        return hosts
+        try:
+            return shlex.split(host)
+        except ValueError:
+            raise Exception("Unparsable host %s" % host)
 
 
 class LazyFqdn(object):
diff --git a/paramiko/dsskey.py b/paramiko/dsskey.py
index 1901596d..d7dd6275 100644
--- a/paramiko/dsskey.py
+++ b/paramiko/dsskey.py
@@ -154,6 +154,7 @@ class DSSKey (PKey):
     def write_private_key(self, file_obj, password=None):
         self._write_private_key('DSA', file_obj, self._encode_key(), password)
 
+    @staticmethod
     def generate(bits=1024, progress_func=None):
         """
         Generate a new private DSS key.  This factory function can be used to
@@ -169,7 +170,6 @@ class DSSKey (PKey):
         key = DSSKey(vals=(dsa.p, dsa.q, dsa.g, dsa.y))
         key.x = dsa.x
         return key
-    generate = staticmethod(generate)
 
     ###  internals...
 
diff --git a/paramiko/ecdsakey.py b/paramiko/ecdsakey.py
index a7f3c5ed..8827a1db 100644
--- a/paramiko/ecdsakey.py
+++ b/paramiko/ecdsakey.py
@@ -126,20 +126,18 @@ class ECDSAKey (PKey):
         key = self.signing_key or self.verifying_key
         self._write_private_key('EC', file_obj, key.to_der(), password)
 
+    @staticmethod
     def generate(curve=curves.NIST256p, progress_func=None):
         """
-        Generate a new private RSA key.  This factory function can be used to
+        Generate a new private ECDSA key.  This factory function can be used to
         generate a new host key or authentication key.
 
-        :param function progress_func:
-            an optional function to call at key points in key generation (used
-            by ``pyCrypto.PublicKey``).
-        :returns: A new private key (`.RSAKey`) object
+        :param function progress_func: Not used for this type of key.
+        :returns: A new private key (`.ECDSAKey`) object
         """
         signing_key = SigningKey.generate(curve)
         key = ECDSAKey(vals=(signing_key, signing_key.get_verifying_key()))
         return key
-    generate = staticmethod(generate)
 
     ###  internals...
 
diff --git a/paramiko/file.py b/paramiko/file.py
index 311e1982..e3b0a16a 100644
--- a/paramiko/file.py
+++ b/paramiko/file.py
@@ -206,6 +206,7 @@ class BufferedFile (ClosingContextManager):
         if not (self._flags & self.FLAG_READ):
             raise IOError('File not open for reading')
         line = self._rbuffer
+        truncated = False
         while True:
             if self._at_trailing_cr and (self._flags & self.FLAG_UNIVERSAL_NEWLINE) and (len(line) > 0):
                 # edge case: the newline may be '\r\n' and we may have read
@@ -220,11 +221,11 @@ class BufferedFile (ClosingContextManager):
             # enough.
             if (size is not None) and (size >= 0):
                 if len(line) >= size:
-                    # truncate line and return
+                    # truncate line
                     self._rbuffer = line[size:]
                     line = line[:size]
-                    self._pos += len(line)
-                    return line if self._flags & self.FLAG_BINARY else u(line)
+                    truncated = True
+                    break
                 n = size - len(line)
             else:
                 n = self._bufsize
@@ -246,10 +247,17 @@ class BufferedFile (ClosingContextManager):
             rpos = line.find(cr_byte)
             if (rpos >= 0) and (rpos < pos or pos < 0):
                 pos = rpos
+        if pos == -1:
+            # we couldn't find a newline in the truncated string, return it
+            self._pos += len(line)
+            return line if self._flags & self.FLAG_BINARY else u(line)
         xpos = pos + 1
         if (line[pos] == cr_byte_value) and (xpos < len(line)) and (line[xpos] == linefeed_byte_value):
             xpos += 1
-        self._rbuffer = line[xpos:]
+        # if the string was truncated, _rbuffer needs to have the string after 
+        # the newline character plus the truncated part of the line we stored
+        # earlier in _rbuffer
+        self._rbuffer = line[xpos:] + self._rbuffer if truncated else line[xpos:]
         lf = line[pos:xpos]
         line = line[:pos] + linefeed_byte
         if (len(self._rbuffer) == 0) and (lf == cr_byte):
diff --git a/paramiko/hostkeys.py b/paramiko/hostkeys.py
index b94ff0db..c7e1f72e 100644
--- a/paramiko/hostkeys.py
+++ b/paramiko/hostkeys.py
@@ -35,6 +35,7 @@ from paramiko.dsskey import DSSKey
 from paramiko.rsakey import RSAKey
 from paramiko.util import get_logger, constant_time_bytes_eq
 from paramiko.ecdsakey import ECDSAKey
+from paramiko.ssh_exception import SSHException
 
 
 class HostKeys (MutableMapping):
@@ -96,7 +97,10 @@ class HostKeys (MutableMapping):
                 line = line.strip()
                 if (len(line) == 0) or (line[0] == '#'):
                     continue
-                e = HostKeyEntry.from_line(line, lineno)
+                try:
+                    e = HostKeyEntry.from_line(line, lineno)
+                except SSHException:
+                    continue
                 if e is not None:
                     _hostnames = e.hostnames
                     for h in _hostnames:
@@ -255,6 +259,7 @@ class HostKeys (MutableMapping):
             ret.append(self.lookup(k))
         return ret
 
+    @staticmethod
     def hash_host(hostname, salt=None):
         """
         Return a "hashed" form of the hostname, as used by OpenSSH when storing
@@ -274,7 +279,6 @@ class HostKeys (MutableMapping):
         hmac = HMAC(salt, b(hostname), sha1).digest()
         hostkey = '|1|%s|%s' % (u(encodebytes(salt)), u(encodebytes(hmac)))
         return hostkey.replace('\n', '')
-    hash_host = staticmethod(hash_host)
 
 
 class InvalidHostKey(Exception):
@@ -294,6 +298,7 @@ class HostKeyEntry:
         self.hostnames = hostnames
         self.key = key
 
+    @classmethod
     def from_line(cls, line, lineno=None):
         """
         Parses the given line of text to find the names for the host,
@@ -336,7 +341,6 @@ class HostKeyEntry:
             raise InvalidHostKey(line, e)
 
         return cls(names, key)
-    from_line = classmethod(from_line)
 
     def to_line(self):
         """
diff --git a/paramiko/kex_gss.py b/paramiko/kex_gss.py
index 4e8380ef..69969f8a 100644
--- a/paramiko/kex_gss.py
+++ b/paramiko/kex_gss.py
@@ -21,14 +21,15 @@
 
 
 """
-This module provides GSS-API / SSPI Key Exchange as defined in RFC 4462.
+This module provides GSS-API / SSPI Key Exchange as defined in :rfc:`4462`.
 
 .. note:: Credential delegation is not supported in server mode.
 
 .. note::
-    `RFC 4462 Section 2.2 <http://www.ietf.org/rfc/rfc4462.txt>`_ says we are
-    not required to implement GSS-API error messages. Thus, in many methods
-    within this module, if an error occurs an exception will be thrown and the
+    `RFC 4462 Section 2.2
+    <https://tools.ietf.org/html/rfc4462.html#section-2.2>`_ says we are not
+    required to implement GSS-API error messages. Thus, in many methods within
+    this module, if an error occurs an exception will be thrown and the
     connection will be terminated.
 
 .. seealso:: :doc:`/api/ssh_gss`
@@ -36,6 +37,7 @@ This module provides GSS-API / SSPI Key Exchange as defined in RFC 4462.
 .. versionadded:: 1.15
 """
 
+import os
 from hashlib import sha1
 
 from paramiko.common import *
@@ -55,8 +57,8 @@ c_MSG_KEXGSS_GROUPREQ, c_MSG_KEXGSS_GROUP = [byte_chr(c) for c in range(40, 42)]
 
 class KexGSSGroup1(object):
     """
-    GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange
-    as defined in `RFC 4462 Section 2 <http://www.ietf.org/rfc/rfc4462.txt>`_
+    GSS-API / SSPI Authenticated Diffie-Hellman Key Exchange as defined in `RFC
+    4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
     """
     # draft-ietf-secsh-transport-09.txt, page 17
     P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF
@@ -129,7 +131,7 @@ class KexGSSGroup1(object):
         larger than q (but this is a tiny tiny subset of potential x).
         """
         while 1:
-            x_bytes = self.transport.rng.read(128)
+            x_bytes = os.urandom(128)
             x_bytes = byte_mask(x_bytes[0], 0x7f) + x_bytes[1:]
             if (x_bytes[:8] != self.b7fffffffffffffff) and \
                    (x_bytes[:8] != self.b0000000000000000):
@@ -278,8 +280,9 @@ class KexGSSGroup1(object):
 
 class KexGSSGroup14(KexGSSGroup1):
     """
-    GSS-API / SSPI Authenticated Diffie-Hellman Group14 Key Exchange
-    as defined in `RFC 4462 Section 2 <http://www.ietf.org/rfc/rfc4462.txt>`_
+    GSS-API / SSPI Authenticated Diffie-Hellman Group14 Key Exchange as defined
+    in `RFC 4462 Section 2
+    <https://tools.ietf.org/html/rfc4462.html#section-2>`_
     """
     P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF
     G = 2
@@ -288,8 +291,8 @@ class KexGSSGroup14(KexGSSGroup1):
 
 class KexGSSGex(object):
     """
-    GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange
-    as defined in `RFC 4462 Section 2 <http://www.ietf.org/rfc/rfc4462.txt>`_
+    GSS-API / SSPI Authenticated Diffie-Hellman Group Exchange as defined in
+    `RFC 4462 Section 2 <https://tools.ietf.org/html/rfc4462.html#section-2>`_
     """
     NAME = "gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g=="
     min_bits = 1024
@@ -364,7 +367,7 @@ class KexGSSGex(object):
             qhbyte <<= 1
             qmask >>= 1
         while True:
-            x_bytes = self.transport.rng.read(byte_count)
+            x_bytes = os.urandom(byte_count)
             x_bytes = byte_mask(x_bytes[0], qmask) + x_bytes[1:]
             x = util.inflate_long(x_bytes, 1)
             if (x > 1) and (x < q):
@@ -590,8 +593,9 @@ class KexGSSGex(object):
 
 class NullHostKey(object):
     """
-    This class represents the Null Host Key for GSS-API Key Exchange
-    as defined in `RFC 4462 Section 5 <http://www.ietf.org/rfc/rfc4462.txt>`_
+    This class represents the Null Host Key for GSS-API Key Exchange as defined
+    in `RFC 4462 Section 5
+    <https://tools.ietf.org/html/rfc4462.html#section-5>`_
     """
     def __init__(self):
         self.key = ""
diff --git a/paramiko/message.py b/paramiko/message.py
index b893e76d..bf4c6b95 100644
--- a/paramiko/message.py
+++ b/paramiko/message.py
@@ -129,7 +129,7 @@ class Message (object):
         b = self.get_bytes(1)
         return b != zero_byte
 
-    def get_int(self):
+    def get_adaptive_int(self):
         """
         Fetch an int from the stream.
 
@@ -141,20 +141,7 @@ class Message (object):
         byte += self.get_bytes(3)
         return struct.unpack('>I', byte)[0]
 
-    def get_size(self):
-        """
-        Fetch an int from the stream.
-
-        @return: a 32-bit unsigned integer.
-        @rtype: int
-        """
-        byte = self.get_bytes(1)
-        if byte == max_byte:
-            return util.inflate_long(self.get_binary())
-        byte += self.get_bytes(3)
-        return struct.unpack('>I', byte)[0]
-
-    def get_size(self):
+    def get_int(self):
         """
         Fetch an int from the stream.
 
@@ -185,7 +172,7 @@ class Message (object):
         contain unprintable characters.  (It's not unheard of for a string to
         contain another byte-stream message.)
         """
-        return self.get_bytes(self.get_size())
+        return self.get_bytes(self.get_int())
 
     def get_text(self):
         """
@@ -196,7 +183,7 @@ class Message (object):
         @return: a string.
         @rtype: string
         """
-        return u(self.get_bytes(self.get_size()))
+        return u(self.get_bytes(self.get_int()))
         #return self.get_bytes(self.get_size())
 
     def get_binary(self):
@@ -208,7 +195,7 @@ class Message (object):
         @return: a string.
         @rtype: string
         """
-        return self.get_bytes(self.get_size())
+        return self.get_bytes(self.get_int())
 
     def get_list(self):
         """
@@ -248,7 +235,7 @@ class Message (object):
             self.packet.write(zero_byte)
         return self
             
-    def add_size(self, n):
+    def add_int(self, n):
         """
         Add an integer to the stream.
         
@@ -257,7 +244,7 @@ class Message (object):
         self.packet.write(struct.pack('>I', n))
         return self
             
-    def add_int(self, n):
+    def add_adaptive_int(self, n):
         """
         Add an integer to the stream.
         
@@ -270,20 +257,6 @@ class Message (object):
             self.packet.write(struct.pack('>I', n))
         return self
 
-    def add_int(self, n):
-        """
-        Add an integer to the stream.
-
-        @param n: integer to add
-        @type n: int
-        """
-        if n >= Message.big_int:
-            self.packet.write(max_byte)
-            self.add_string(util.deflate_long(n))
-        else:
-            self.packet.write(struct.pack('>I', n))
-        return self
-
     def add_int64(self, n):
         """
         Add a 64-bit int to the stream.
@@ -310,7 +283,7 @@ class Message (object):
         :param str s: string to add
         """
         s = asbytes(s)
-        self.add_size(len(s))
+        self.add_int(len(s))
         self.packet.write(s)
         return self
 
@@ -329,7 +302,7 @@ class Message (object):
         if type(i) is bool:
             return self.add_boolean(i)
         elif isinstance(i, integer_types):
-            return self.add_int(i)
+            return self.add_adaptive_int(i)
         elif type(i) is list:
             return self.add_list(i)
         else:
diff --git a/paramiko/packet.py b/paramiko/packet.py
index f516ff9b..b922000c 100644
--- a/paramiko/packet.py
+++ b/paramiko/packet.py
@@ -99,6 +99,10 @@ class Packetizer (object):
         self.__keepalive_last = time.time()
         self.__keepalive_callback = None
 
+        self.__timer = None
+        self.__handshake_complete = False
+        self.__timer_expired = False
+
     def set_log(self, log):
         """
         Set the Python log object to use for logging.
@@ -182,6 +186,45 @@ class Packetizer (object):
         self.__keepalive_callback = callback
         self.__keepalive_last = time.time()
 
+    def read_timer(self):
+        self.__timer_expired = True
+
+    def start_handshake(self, timeout):
+        """
+        Tells `Packetizer` that the handshake process started.
+        Starts a book keeping timer that can signal a timeout in the
+        handshake process.
+
+        :param float timeout: amount of seconds to wait before timing out
+        """
+        if not self.__timer:
+            self.__timer = threading.Timer(float(timeout), self.read_timer)
+            self.__timer.start()
+
+    def handshake_timed_out(self):
+        """
+        Checks if the handshake has timed out.
+        If `start_handshake` wasn't called before the call to this function
+        the return value will always be `False`.
+        If the handshake completed before a time out was reached the return value will be `False`
+
+        :return: handshake time out status, as a `bool`
+        """
+        if not self.__timer:
+            return False
+        if self.__handshake_complete:
+            return False
+        return self.__timer_expired
+
+    def complete_handshake(self):
+        """
+        Tells `Packetizer` that the handshake has completed.
+        """
+        if self.__timer:
+            self.__timer.cancel()
+            self.__timer_expired = False
+            self.__handshake_complete = True
+
     def read_all(self, n, check_rekey=False):
         """
         Read as close to N bytes as possible, blocking as long as necessary.
@@ -200,6 +243,8 @@ class Packetizer (object):
             n -= len(out)
         while n > 0:
             got_timeout = False
+            if self.handshake_timed_out():
+                raise EOFError()
             try:
                 x = self.__socket.recv(n)
                 if len(x) == 0:
diff --git a/paramiko/pkey.py b/paramiko/pkey.py
index 2daf3723..1b4af010 100644
--- a/paramiko/pkey.py
+++ b/paramiko/pkey.py
@@ -160,6 +160,7 @@ class PKey (object):
         """
         return False
 
+    @classmethod
     def from_private_key_file(cls, filename, password=None):
         """
         Create a key object by reading a private key file.  If the private
@@ -181,8 +182,8 @@ class PKey (object):
         """
         key = cls(filename=filename, password=password)
         return key
-    from_private_key_file = classmethod(from_private_key_file)
 
+    @classmethod
     def from_private_key(cls, file_obj, password=None):
         """
         Create a key object by reading a private key from a file (or file-like)
@@ -202,7 +203,6 @@ class PKey (object):
         """
         key = cls(file_obj=file_obj, password=password)
         return key
-    from_private_key = classmethod(from_private_key)
 
     def write_private_key_file(self, filename, password=None):
         """
diff --git a/paramiko/proxy.py b/paramiko/proxy.py
index 0664ac6e..ca602c4c 100644
--- a/paramiko/proxy.py
+++ b/paramiko/proxy.py
@@ -24,6 +24,7 @@ import signal
 from subprocess import Popen, PIPE
 from select import select
 import socket
+import time
 
 from paramiko.ssh_exception import ProxyCommandFailure
 from paramiko.util import ClosingContextManager
@@ -79,20 +80,24 @@ class ProxyCommand(ClosingContextManager):
         :return: the length of the read content, as an `int`
         """
         try:
-            start = datetime.now()
+            start = time.time()
             while len(self.buffer) < size:
+                select_timeout = None
                 if self.timeout is not None:
-                    elapsed = (datetime.now() - start).microseconds
-                    timeout = self.timeout * 1000 * 1000  # to microseconds
-                    if elapsed >= timeout:
+                    elapsed = (time.time() - start)
+                    if elapsed >= self.timeout:
                         raise socket.timeout()
-                r, w, x = select([self.process.stdout], [], [], 0.0)
+                    select_timeout = self.timeout - elapsed
+
+                r, w, x = select(
+                    [self.process.stdout], [], [], select_timeout)
                 if r and r[0] == self.process.stdout:
-                    b = os.read(self.process.stdout.fileno(), 1)
+                    b = os.read(
+                        self.process.stdout.fileno(), size - len(self.buffer))
                     # Store in class-level buffer for persistence across
                     # timeouts; this makes us act more like a real socket
                     # (where timeouts don't actually drop data.)
-                    self.buffer.append(b)
+                    self.buffer.extend(b)
             result = ''.join(self.buffer)
             self.buffer = []
             return result
diff --git a/paramiko/rsakey.py b/paramiko/rsakey.py
index d1f3ecfe..4ebd8354 100644
--- a/paramiko/rsakey.py
+++ b/paramiko/rsakey.py
@@ -131,6 +131,7 @@ class RSAKey (PKey):
     def write_private_key(self, file_obj, password=None):
         self._write_private_key('RSA', file_obj, self._encode_key(), password)
 
+    @staticmethod
     def generate(bits, progress_func=None):
         """
         Generate a new private RSA key.  This factory function can be used to
@@ -148,7 +149,6 @@ class RSAKey (PKey):
         key.p = rsa.p
         key.q = rsa.q
         return key
-    generate = staticmethod(generate)
 
     ###  internals...
 
diff --git a/paramiko/server.py b/paramiko/server.py
index bf5039a2..f79a1748 100644
--- a/paramiko/server.py
+++ b/paramiko/server.py
@@ -22,7 +22,7 @@
 
 import threading
 from paramiko import util
-from paramiko.common import DEBUG, ERROR, OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED, AUTH_FAILED
+from paramiko.common import DEBUG, ERROR, OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED, AUTH_FAILED, AUTH_SUCCESSFUL
 from paramiko.py3compat import string_types
 
 
diff --git a/paramiko/sftp_attr.py b/paramiko/sftp_attr.py
index d12eff8d..cf48f654 100644
--- a/paramiko/sftp_attr.py
+++ b/paramiko/sftp_attr.py
@@ -60,6 +60,7 @@ class SFTPAttributes (object):
         self.st_mtime = None
         self.attr = {}
 
+    @classmethod
     def from_stat(cls, obj, filename=None):
         """
         Create an `.SFTPAttributes` object from an existing ``stat`` object (an
@@ -79,13 +80,12 @@ class SFTPAttributes (object):
         if filename is not None:
             attr.filename = filename
         return attr
-    from_stat = classmethod(from_stat)
 
     def __repr__(self):
         return '<SFTPAttributes: %s>' % self._debug_str()
 
     ###  internals...
-
+    @classmethod
     def _from_msg(cls, msg, filename=None, longname=None):
         attr = cls()
         attr._unpack(msg)
@@ -94,7 +94,6 @@ class SFTPAttributes (object):
         if longname is not None:
             attr.longname = longname
         return attr
-    _from_msg = classmethod(_from_msg)
 
     def _unpack(self, msg):
         self._flags = msg.get_int()
@@ -159,6 +158,7 @@ class SFTPAttributes (object):
         out += ']'
         return out
 
+    @staticmethod
     def _rwx(n, suid, sticky=False):
         if suid:
             suid = 2
@@ -168,7 +168,6 @@ class SFTPAttributes (object):
         else:
             out += '-xSs'[suid + (n & 1)]
         return out
-    _rwx = staticmethod(_rwx)
 
     def __str__(self):
         """create a unix-style long description of the file (like ls -l)"""
diff --git a/paramiko/sftp_client.py b/paramiko/sftp_client.py
index 62127cc2..6d48e692 100644
--- a/paramiko/sftp_client.py
+++ b/paramiko/sftp_client.py
@@ -65,7 +65,7 @@ class SFTPClient(BaseSFTP, ClosingContextManager):
 
     Used to open an SFTP session across an open SSH `.Transport` and perform
     remote file operations.
-    
+
     Instances of this class may be used as context managers.
     """
     def __init__(self, sock):
@@ -101,6 +101,7 @@ class SFTPClient(BaseSFTP, ClosingContextManager):
             raise SSHException('EOF during negotiation')
         self._log(INFO, 'Opened sftp connection (server version %d)' % server_version)
 
+    @classmethod
     def from_transport(cls, t, window_size=None, max_packet_size=None):
         """
         Create an SFTP client channel from an open `.Transport`.
@@ -129,7 +130,6 @@ class SFTPClient(BaseSFTP, ClosingContextManager):
             return None
         chan.invoke_subsystem('sftp')
         return cls(chan)
-    from_transport = classmethod(from_transport)
 
     def _log(self, level, msg, *args):
         if isinstance(msg, list):
@@ -589,6 +589,7 @@ class SFTPClient(BaseSFTP, ClosingContextManager):
 
         .. versionadded:: 1.4
         """
+        # TODO: make class initialize with self._cwd set to self.normalize('.')
         return self._cwd and u(self._cwd)
 
     def putfo(self, fl, remotepath, file_size=0, callback=None, confirm=True):
diff --git a/paramiko/sftp_server.py b/paramiko/sftp_server.py
index 2d8d1909..ce287e8f 100644
--- a/paramiko/sftp_server.py
+++ b/paramiko/sftp_server.py
@@ -129,6 +129,7 @@ class SFTPServer (BaseSFTP, SubsystemHandler):
         self.file_table = {}
         self.folder_table = {}
 
+    @staticmethod
     def convert_errno(e):
         """
         Convert an errno value (as from an ``OSError`` or ``IOError``) into a
@@ -146,8 +147,8 @@ class SFTPServer (BaseSFTP, SubsystemHandler):
             return SFTP_NO_SUCH_FILE
         else:
             return SFTP_FAILURE
-    convert_errno = staticmethod(convert_errno)
 
+    @staticmethod
     def set_file_attr(filename, attr):
         """
         Change a file's attributes on the local filesystem.  The contents of
@@ -173,7 +174,6 @@ class SFTPServer (BaseSFTP, SubsystemHandler):
         if attr._flags & attr.FLAG_SIZE:
             with open(filename, 'w+') as f:
                 f.truncate(attr.st_size)
-    set_file_attr = staticmethod(set_file_attr)
 
     ###  internals...
 
diff --git a/paramiko/ssh_exception.py b/paramiko/ssh_exception.py
index b99e42b3..02f3e52e 100644
--- a/paramiko/ssh_exception.py
+++ b/paramiko/ssh_exception.py
@@ -16,6 +16,8 @@
 # along with Paramiko; if not, write to the Free Software Foundation, Inc.,
 # 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA.
 
+import socket
+
 
 class SSHException (Exception):
     """
@@ -105,7 +107,11 @@ class BadHostKeyException (SSHException):
     .. versionadded:: 1.6
     """
     def __init__(self, hostname, got_key, expected_key):
-        SSHException.__init__(self, 'Host key for server %s does not match!' % hostname)
+        SSHException.__init__(self,
+                              'Host key for server %s does not match : got %s expected %s' % (
+                                  hostname,
+                                  got_key.get_base64(),
+                                  expected_key.get_base64()))
         self.hostname = hostname
         self.key = got_key
         self.expected_key = expected_key
@@ -129,3 +135,39 @@ class ProxyCommandFailure (SSHException):
         self.error = error
         # for unpickling
         self.args = (command, error, )
+
+
+class NoValidConnectionsError(socket.error):
+    """
+    Multiple connection attempts were made and no families succeeded.
+
+    This exception class wraps multiple "real" underlying connection errors,
+    all of which represent failed connection attempts. Because these errors are
+    not guaranteed to all be of the same error type (i.e. different errno,
+    `socket.error` subclass, message, etc) we expose a single unified error
+    message and a ``None`` errno so that instances of this class match most
+    normal handling of `socket.error` objects.
+    
+    To see the wrapped exception objects, access the ``errors`` attribute.
+    ``errors`` is a dict whose keys are address tuples (e.g. ``('127.0.0.1',
+    22)``) and whose values are the exception encountered trying to connect to
+    that address.
+
+    It is implied/assumed that all the errors given to a single instance of
+    this class are from connecting to the same hostname + port (and thus that
+    the differences are in the resolution of the hostname - e.g. IPv4 vs v6).
+    """
+    def __init__(self, errors):
+        """
+        :param dict errors:
+            The errors dict to store, as described by class docstring.
+        """
+        addrs = errors.keys()
+        body = ', '.join([x[0] for x in addrs[:-1]])
+        tail = addrs[-1][0]
+        msg = "Unable to connect to port {0} on {1} or {2}"
+        super(NoValidConnectionsError, self).__init__(
+            None, # stand-in for errno
+            msg.format(addrs[0][1], body, tail)
+        )
+        self.errors = errors
diff --git a/paramiko/ssh_gss.py b/paramiko/ssh_gss.py
index ebf2cc80..e9b13a66 100644
--- a/paramiko/ssh_gss.py
+++ b/paramiko/ssh_gss.py
@@ -20,7 +20,7 @@
 
 
 """
-This module provides GSS-API / SSPI  authentication as defined in RFC 4462.
+This module provides GSS-API / SSPI  authentication as defined in :rfc:`4462`.
 
 .. note:: Credential delegation is not supported in server mode.
 
@@ -360,8 +360,8 @@ class _SSH_GSSAPI(_SSH_GSSAuth):
         :param str mic_token: The MIC token received from the client
         :param str session_id: The SSH session ID
         :param str username: The name of the user who attempts to login
-        :return: 0 if the MIC check was successful and 1 if it fails
-        :rtype: int
+        :return: None if the MIC check was successful
+        :raises gssapi.GSSException: if the MIC check failed
         """
         self._session_id = session_id
         self._username = username
@@ -371,11 +371,7 @@ class _SSH_GSSAPI(_SSH_GSSAuth):
                                         self._username,
                                         self._service,
                                         self._auth_method)
-            try:
-                self._gss_srv_ctxt.verify_mic(mic_field,
-                                              mic_token)
-            except gssapi.BadSignature:
-                raise Exception("GSS-API MIC check failed.")
+            self._gss_srv_ctxt.verify_mic(mic_field, mic_token)
         else:
             # for key exchange with gssapi-keyex
             # client mode
@@ -534,31 +530,26 @@ class _SSH_SSPI(_SSH_GSSAuth):
         :param str mic_token: The MIC token received from the client
         :param str session_id: The SSH session ID
         :param str username: The name of the user who attempts to login
-        :return: 0 if the MIC check was successful
-        :rtype: int
+        :return: None if the MIC check was successful
+        :raises sspi.error: if the MIC check failed
         """
         self._session_id = session_id
         self._username = username
-        mic_status = 1
         if username is not None:
             # server mode
             mic_field = self._ssh_build_mic(self._session_id,
                                             self._username,
                                             self._service,
                                             self._auth_method)
-            mic_status = self._gss_srv_ctxt.verify(mic_field,
-                                                   mic_token)
+            # Verifies data and its signature.  If verification fails, an 
+            # sspi.error will be raised.
+            self._gss_srv_ctxt.verify(mic_field, mic_token)
         else:
             # for key exchange with gssapi-keyex
             # client mode
-            mic_status = self._gss_ctxt.verify(self._session_id,
-                                               mic_token)
-        """
-        The SSPI method C{verify} has no return value, so if no SSPI error
-        is returned, set C{mic_status} to 0.
-        """
-        mic_status = 0
-        return mic_status
+            # Verifies data and its signature.  If verification fails, an 
+            # sspi.error will be raised.
+            self._gss_ctxt.verify(self._session_id, mic_token)
 
     @property
     def credentials_delegated(self):
diff --git a/paramiko/transport.py b/paramiko/transport.py
index 5ab5ac95..ef57108a 100644
--- a/paramiko/transport.py
+++ b/paramiko/transport.py
@@ -43,8 +43,8 @@ from paramiko.common import xffffffff, cMSG_CHANNEL_OPEN, cMSG_IGNORE, \
     MSG_CHANNEL_OPEN_SUCCESS, MSG_CHANNEL_OPEN_FAILURE, MSG_CHANNEL_OPEN, \
     MSG_CHANNEL_SUCCESS, MSG_CHANNEL_FAILURE, MSG_CHANNEL_DATA, \
     MSG_CHANNEL_EXTENDED_DATA, MSG_CHANNEL_WINDOW_ADJUST, MSG_CHANNEL_REQUEST, \
-    MSG_CHANNEL_EOF, MSG_CHANNEL_CLOSE, MIN_PACKET_SIZE, MAX_WINDOW_SIZE, \
-    DEFAULT_WINDOW_SIZE, DEFAULT_MAX_PACKET_SIZE
+    MSG_CHANNEL_EOF, MSG_CHANNEL_CLOSE, MIN_WINDOW_SIZE, MIN_PACKET_SIZE, \
+    MAX_WINDOW_SIZE, DEFAULT_WINDOW_SIZE, DEFAULT_MAX_PACKET_SIZE
 from paramiko.compress import ZlibCompressor, ZlibDecompressor
 from paramiko.dsskey import DSSKey
 from paramiko.kex_gex import KexGex, KexGexSHA256
@@ -88,7 +88,7 @@ class Transport (threading.Thread, ClosingContextManager):
     `channels <.Channel>`, across the session.  Multiple channels can be
     multiplexed across a single session (and often are, in the case of port
     forwardings).
-    
+
     Instances of this class may be used as context managers.
     """
     _PROTO_ID = '2.0'
@@ -283,7 +283,7 @@ class Transport (threading.Thread, ClosingContextManager):
         self._channels = ChannelMap()
         self.channel_events = {}       # (id -> Event)
         self.channels_seen = {}        # (id -> True)
-        self._channel_counter = 1
+        self._channel_counter = 0
         self.default_max_packet_size = default_max_packet_size
         self.default_window_size = default_window_size
         self._forward_agent_handler = None
@@ -301,6 +301,8 @@ class Transport (threading.Thread, ClosingContextManager):
         self.global_response = None     # response Message from an arbitrary global request
         self.completion_event = None    # user-defined event callbacks
         self.banner_timeout = 15        # how long (seconds) to wait for the SSH banner
+        self.handshake_timeout = 15     # how long (seconds) to wait for the handshake to finish after SSH banner sent.
+
 
         # server mode:
         self.server_mode = False
@@ -411,7 +413,7 @@ class Transport (threading.Thread, ClosingContextManager):
                 if e is not None:
                     raise e
                 raise SSHException('Negotiation failed.')
-            if event.isSet():
+            if event.is_set():
                 break
 
     def start_server(self, event=None, server=None):
@@ -476,7 +478,7 @@ class Transport (threading.Thread, ClosingContextManager):
                 if e is not None:
                     raise e
                 raise SSHException('Negotiation failed.')
-            if event.isSet():
+            if event.is_set():
                 break
 
     def add_server_key(self, key):
@@ -514,6 +516,7 @@ class Transport (threading.Thread, ClosingContextManager):
             pass
         return None
 
+    @staticmethod
     def load_server_moduli(filename=None):
         """
         (optional)
@@ -553,7 +556,6 @@ class Transport (threading.Thread, ClosingContextManager):
         # none succeeded
         Transport._modulus_pack = None
         return False
-    load_server_moduli = staticmethod(load_server_moduli)
 
     def close(self):
         """
@@ -593,7 +595,7 @@ class Transport (threading.Thread, ClosingContextManager):
         """
         return self.active
 
-    def open_session(self, window_size=None, max_packet_size=None):
+    def open_session(self, window_size=None, max_packet_size=None, timeout=None):
         """
         Request a new channel to the server, of type ``"session"``.  This is
         just an alias for calling `open_channel` with an argument of
@@ -618,7 +620,8 @@ class Transport (threading.Thread, ClosingContextManager):
         """
         return self.open_channel('session',
                                  window_size=window_size,
-                                 max_packet_size=max_packet_size)
+                                 max_packet_size=max_packet_size,
+                                 timeout=timeout)
 
     def open_x11_channel(self, src_addr=None):
         """
@@ -665,7 +668,8 @@ class Transport (threading.Thread, ClosingContextManager):
                      dest_addr=None,
                      src_addr=None,
                      window_size=None,
-                     max_packet_size=None):
+                     max_packet_size=None,
+                     timeout=None):
         """
         Request a new channel to the server. `Channels <.Channel>` are
         socket-like objects used for the actual transfer of data across the
@@ -689,17 +693,20 @@ class Transport (threading.Thread, ClosingContextManager):
             optional window size for this session.
         :param int max_packet_size:
             optional max packet size for this session.
+        :param float timeout:
+            optional timeout opening a channel, default 3600s (1h)
 
         :return: a new `.Channel` on success
 
-        :raises SSHException: if the request is rejected or the session ends
-            prematurely
+        :raises SSHException: if the request is rejected, the session ends
+            prematurely or there is a timeout openning a channel
 
         .. versionchanged:: 1.15
             Added the ``window_size`` and ``max_packet_size`` arguments.
         """
         if not self.active:
             raise SSHException('SSH session not active')
+        timeout = 3600 if timeout is None else timeout
         self.lock.acquire()
         try:
             window_size = self._sanitize_window_size(window_size)
@@ -728,6 +735,7 @@ class Transport (threading.Thread, ClosingContextManager):
         finally:
             self.lock.release()
         self._send_user_message(m)
+        start_ts = time.time()
         while True:
             event.wait(0.1)
             if not self.active:
@@ -735,8 +743,10 @@ class Transport (threading.Thread, ClosingContextManager):
                 if e is None:
                     e = SSHException('Unable to open channel.')
                 raise e
-            if event.isSet():
+            if event.is_set():
                 break
+            elif start_ts + timeout < time.time():
+                raise SSHException('Timeout openning channel.')
         chan = self._channels.get(chanid)
         if chan is not None:
             return chan
@@ -855,7 +865,7 @@ class Transport (threading.Thread, ClosingContextManager):
                 if e is not None:
                     raise e
                 raise SSHException('Negotiation failed.')
-            if self.completion_event.isSet():
+            if self.completion_event.is_set():
                 break
         return
 
@@ -906,7 +916,7 @@ class Transport (threading.Thread, ClosingContextManager):
             self.completion_event.wait(0.1)
             if not self.active:
                 return None
-            if self.completion_event.isSet():
+            if self.completion_event.is_set():
                 break
         return self.global_response
 
@@ -1080,6 +1090,8 @@ class Transport (threading.Thread, ClosingContextManager):
         supplied, this method returns ``None``.
 
         :returns: server supplied banner (`str`), or ``None``.
+
+        .. versionadded:: 1.13
         """
         if not self.active or (self.auth_handler is None):
             return None
@@ -1465,7 +1477,7 @@ class Transport (threading.Thread, ClosingContextManager):
                 self._log(DEBUG, 'Dropping user packet because connection is dead.')
                 return
             self.clear_to_send_lock.acquire()
-            if self.clear_to_send.isSet():
+            if self.clear_to_send.is_set():
                 break
             self.clear_to_send_lock.release()
             if time.time() > start + self.clear_to_send_timeout:
@@ -1559,7 +1571,7 @@ class Transport (threading.Thread, ClosingContextManager):
     def _sanitize_window_size(self, window_size):
         if window_size is None:
             window_size = self.default_window_size
-        return clamp_value(MIN_PACKET_SIZE, window_size, MAX_WINDOW_SIZE)
+        return clamp_value(MIN_WINDOW_SIZE, window_size, MAX_WINDOW_SIZE)
 
     def _sanitize_packet_size(self, max_packet_size):
         if max_packet_size is None:
@@ -1587,6 +1599,12 @@ class Transport (threading.Thread, ClosingContextManager):
             try:
                 self.packetizer.write_all(b(self.local_version + '\r\n'))
                 self._check_banner()
+                # The above is actually very much part of the handshake, but sometimes the banner can be read
+                # but the machine is not responding, for example when the remote ssh daemon is loaded in to memory
+                # but we can not read from the disk/spawn a new shell.
+                # Make sure we can specify a timeout for the initial handshake.
+                # Re-use the banner timeout for now.
+                self.packetizer.start_handshake(self.handshake_timeout)
                 self._send_kex_init()
                 self._expect_packet(MSG_KEXINIT)
 
@@ -1636,6 +1654,7 @@ class Transport (threading.Thread, ClosingContextManager):
                         msg.add_byte(cMSG_UNIMPLEMENTED)
                         msg.add_int(m.seqno)
                         self._send_message(msg)
+                    self.packetizer.complete_handshake()
             except SSHException as e:
                 self._log(ERROR, 'Exception: ' + str(e))
                 self._log(ERROR, util.tb_strings())
@@ -2216,21 +2235,6 @@ class SecurityOptions (object):
         """
         return '<paramiko.SecurityOptions for %s>' % repr(self._transport)
 
-    def _get_ciphers(self):
-        return self._transport._preferred_ciphers
-
-    def _get_digests(self):
-        return self._transport._preferred_macs
-
-    def _get_key_types(self):
-        return self._transport._preferred_keys
-
-    def _get_kex(self):
-        return self._transport._preferred_kex
-
-    def _get_compression(self):
-        return self._transport._preferred_compression
-
     def _set(self, name, orig, x):
         if type(x) is list:
             x = tuple(x)
@@ -2242,30 +2246,51 @@ class SecurityOptions (object):
             raise ValueError('unknown cipher')
         setattr(self._transport, name, x)
 
-    def _set_ciphers(self, x):
+    @property
+    def ciphers(self):
+        """Symmetric encryption ciphers"""
+        return self._transport._preferred_ciphers
+
+    @ciphers.setter
+    def ciphers(self, x):
         self._set('_preferred_ciphers', '_cipher_info', x)
 
-    def _set_digests(self, x):
+    @property
+    def digests(self):
+        """Digest (one-way hash) algorithms"""
+        return self._transport._preferred_macs
+
+    @digests.setter
+    def digests(self, x):
         self._set('_preferred_macs', '_mac_info', x)
 
-    def _set_key_types(self, x):
+    @property
+    def key_types(self):
+        """Public-key algorithms"""
+        return self._transport._preferred_keys
+
+    @key_types.setter
+    def key_types(self, x):
         self._set('_preferred_keys', '_key_info', x)
 
-    def _set_kex(self, x):
+
+    @property
+    def kex(self):
+        """Key exchange algorithms"""
+        return self._transport._preferred_kex
+
+    @kex.setter
+    def kex(self, x):
         self._set('_preferred_kex', '_kex_info', x)
 
-    def _set_compression(self, x):
-        self._set('_preferred_compression', '_compression_info', x)
+    @property
+    def compression(self):
+        """Compression algorithms"""
+        return self._transport._preferred_compression
 
-    ciphers = property(_get_ciphers, _set_ciphers, None,
-                       "Symmetric encryption ciphers")
-    digests = property(_get_digests, _set_digests, None,
-                       "Digest (one-way hash) algorithms")
-    key_types = property(_get_key_types, _set_key_types, None,
-                         "Public-key algorithms")
-    kex = property(_get_kex, _set_kex, None, "Key exchange algorithms")
-    compression = property(_get_compression, _set_compression, None,
-                           "Compression algorithms")
+    @compression.setter
+    def compression(self, x):
+        self._set('_preferred_compression', '_compression_info', x)
 
 
 class ChannelMap (object):
diff --git a/paramiko/util.py b/paramiko/util.py
index 3ac64a00..d9a29d74 100644
--- a/paramiko/util.py
+++ b/paramiko/util.py
@@ -23,7 +23,6 @@ Useful functions used by the rest of paramiko.
 from __future__ import generators
 
 import array
-from binascii import hexlify, unhexlify
 import errno
 import sys
 import struct
@@ -106,14 +105,6 @@ def format_binary_line(data):
     return '%-50s %s' % (left, right)
 
 
-def hexify(s):
-    return hexlify(s).upper()
-
-
-def unhexify(s):
-    return unhexlify(s)
-
-
 def safe_string(s):
     out = b('')
     for c in s:
@@ -308,9 +299,9 @@ class Counter (object):
         self.value = array.array('c', zero_byte * (self.blocksize - len(x)) + x)
         return self.value.tostring()
 
+    @classmethod
     def new(cls, nbits, initial_value=long(1), overflow=long(0)):
         return cls(nbits, initial_value=initial_value, overflow=overflow)
-    new = classmethod(new)
 
 
 def constant_time_bytes_eq(a, b):
diff --git a/setup_helper.py b/setup_helper.py
index ff6b0e16..9e3834b3 100644
--- a/setup_helper.py
+++ b/setup_helper.py
@@ -30,9 +30,42 @@ import distutils.archive_util
 from distutils.dir_util import mkpath
 from distutils.spawn import spawn
 
-
-def make_tarball(base_name, base_dir, compress='gzip',
-                 verbose=False, dry_run=False):
+try:
+    from pwd import getpwnam
+except ImportError:
+    getpwnam = None
+
+try:
+    from grp import getgrnam
+except ImportError:
+    getgrnam = None
+
+def _get_gid(name):
+    """Returns a gid, given a group name."""
+    if getgrnam is None or name is None:
+        return None
+    try:
+        result = getgrnam(name)
+    except KeyError:
+        result = None
+    if result is not None:
+        return result[2]
+    return None
+
+def _get_uid(name):
+    """Returns an uid, given a user name."""
+    if getpwnam is None or name is None:
+        return None
+    try:
+        result = getpwnam(name)
+    except KeyError:
+        result = None
+    if result is not None:
+        return result[2]
+    return None
+
+def make_tarball(base_name, base_dir, compress='gzip', verbose=0, dry_run=0,
+                 owner=None, group=None):
     """Create a tar file from all the files under 'base_dir'.
     This file may be compressed.
 
@@ -75,11 +108,30 @@ def make_tarball(base_name, base_dir, compress='gzip',
     mkpath(os.path.dirname(archive_name), dry_run=dry_run)
     log.info('Creating tar file %s with mode %s' % (archive_name, mode))
 
+    uid = _get_uid(owner)
+    gid = _get_gid(group)
+
+    def _set_uid_gid(tarinfo):
+        if gid is not None:
+            tarinfo.gid = gid
+            tarinfo.gname = group
+        if uid is not None:
+            tarinfo.uid = uid
+            tarinfo.uname = owner
+        return tarinfo
+
     if not dry_run:
         tar = tarfile.open(archive_name, mode=mode)
         # This recursively adds everything underneath base_dir
-        tar.add(base_dir)
-        tar.close()
+        try:
+            try:
+                # Support for the `filter' parameter was added in Python 2.7,
+                # earlier versions will raise TypeError.
+                tar.add(base_dir, filter=_set_uid_gid)
+            except TypeError:
+                tar.add(base_dir)
+        finally:
+            tar.close()
 
     if compress and compress not in tarfile_compress_flag:
         spawn([compress] + compress_flags[compress] + [archive_name],
diff --git a/sites/shared_conf.py b/sites/shared_conf.py
index 4a6a5c4e..99fab315 100644
--- a/sites/shared_conf.py
+++ b/sites/shared_conf.py
@@ -12,7 +12,6 @@ html_theme_options = {
     'description': "A Python implementation of SSHv2.",
     'github_user': 'paramiko',
     'github_repo': 'paramiko',
-    'gratipay_user': 'bitprophet',
     'analytics_id': 'UA-18486793-2',
     'travis_button': True,
 }
diff --git a/sites/www/changelog.rst b/sites/www/changelog.rst
index eb9b55ae..ff05365c 100644
--- a/sites/www/changelog.rst
+++ b/sites/www/changelog.rst
@@ -2,12 +2,86 @@
 Changelog
 =========
 
+* :release:`1.15.3 <2015-10-02>`
+* :support:`554 backported` Fix inaccuracies in the docstring for the ECDSA key
+  class. Thanks to Jared Hance for the patch.
+* :support:`516 backported` Document `~paramiko.agent.AgentRequestHandler`.
+  Thanks to ``@toejough`` for report & suggestions.
+* :bug:`496` Fix a handful of small but critical bugs in Paramiko's GSSAPI
+  support (note: this includes switching from PyCrypo's Random to
+  `os.urandom`). Thanks to Anselm Kruis for catch & patch.
+* :bug:`491` (combines :issue:`62` and :issue:`439`) Implement timeout
+  functionality to address hangs from dropped network connections and/or failed
+  handshakes. Credit to ``@vazir`` and ``@dacut`` for the original patches and
+  to Olle Lundberg for reimplementation.
+* :bug:`490` Skip invalid/unparseable lines in ``known_hosts`` files, instead
+  of raising `~paramiko.ssh_exception.SSHException`. This brings Paramiko's
+  behavior more in line with OpenSSH, which silently ignores such input. Catch
+  & patch courtesy of Martin Topholm.
+* :bug:`404` Print details when displaying
+  `~paramiko.ssh_exception.BadHostKeyException` objects (expected vs received
+  data) instead of just "hey shit broke". Patch credit: Loic Dachary.
+* :bug:`469` (also :issue:`488`, :issue:`461` and like a dozen others) Fix a
+  typo introduced in the 1.15 release which broke WinPageant support. Thanks to
+  everyone who submitted patches, and to Steve Cohen who was the lucky winner
+  of the cherry-pick lottery.
+* :bug:`353` (via :issue:`482`) Fix a bug introduced in the Python 3 port
+  which caused ``OverFlowError`` (and other symptoms) in SFTP functionality.
+  Thanks to ``@dboreham`` for leading the troubleshooting charge, and to
+  Scott Maxwell for the final patch.
+* :support:`582` Fix some old ``setup.py`` related helper code which was
+  breaking ``bdist_dumb`` on Mac OS X. Thanks to Peter Odding for the patch.
+* :bug:`22 major` Try harder to connect to multiple network families (e.g. IPv4
+  vs IPv6) in case of connection issues; this helps with problems such as hosts
+  which resolve both IPv4 and IPv6 addresses but are only listening on IPv4.
+  Thanks to Dries Desmet for original report and Torsten Landschoff for the
+  foundational patchset.
+* :bug:`402` Check to see if an SSH agent is actually present before trying to
+  forward it to the remote end. This replaces what was usually a useless
+  ``TypeError`` with a human-readable
+  `~paramiko.ssh_exception.AuthenticationException`. Credit to Ken Jordan for
+  the fix and Yvan Marques for original report.
+* :release:`1.15.2 <2014-12-19>`
+* :release:`1.14.2 <2014-12-19>`
+* :release:`1.13.3 <2014-12-19>`
+* :bug:`413` (also :issue:`414`, :issue:`420`, :issue:`454`) Be significantly
+  smarter about polling & timing behavior when running proxy commands, to avoid
+  unnecessary (often 100%!) CPU usage. Major thanks to Jason Dunsmore for
+  report & initial patchset and to Chris Adams & John Morrissey for followup
+  improvements.
+* :bug:`455` Tweak packet size handling to conform better to the OpenSSH RFCs;
+  this helps address issues with interactive program cursors. Courtesy of Jeff
+  Quast.
+* :bug:`428` Fix an issue in `~paramiko.file.BufferedFile` (primarily used in
+  the SFTP modules) concerning incorrect behavior by
+  `~paramiko.file.BufferedFile.readlines` on files whose size exceeds the
+  buffer size. Thanks to ``@achapp`` for catch & patch.
+* :bug:`415` Fix ``ssh_config`` parsing to correctly interpret ``ProxyCommand
+  none`` as the lack of a proxy command, instead of as a literal command string
+  of ``"none"``. Thanks to Richard Spiers for the catch & Sean Johnson for the
+  fix.
+* :support:`431 backported` Replace handrolled ``ssh_config`` parsing code with
+  use of the ``shlex`` module. Thanks to Yan Kalchevskiy.
+* :support:`422 backported` Clean up some unused imports. Courtesy of Olle
+  Lundberg.
+* :support:`421 backported` Modernize threading calls to user newer API. Thanks
+  to Olle Lundberg.
+* :support:`419 backported` Modernize a bunch of the codebase internals to
+  leverage decorators. Props to ``@beckjake`` for realizing we're no longer on
+  Python 2.2 :D
+* :bug:`266` Change numbering of `~paramiko.transport.Transport` channels to
+  start at 0 instead of 1 for better compatibility with OpenSSH & certain
+  server implementations which break on 1-indexed channels. Thanks to
+  ``@egroeper`` for catch & patch.
+* :bug:`459` Tighten up agent connection closure behavior to avoid spurious
+  ``ResourceWarning`` display in some situations. Thanks to ``@tkrapp`` for the
+  catch.
 * :bug:`429` Server-level debug message logging was overlooked during the
   Python 3 compatibility update; Python 3 clients attempting to log SSH debug
   packets encountered type errors. This is now fixed. Thanks to ``@mjmaenpaa``
   for the catch.
 * :bug:`320` Update our win_pageant module to be Python 3 compatible. Thanks to
-``@sherbang`` and ``@adamkerz`` for the patches.
+  ``@sherbang`` and ``@adamkerz`` for the patches.
 * :release:`1.15.1 <2014-09-22>`
 * :bug:`399` SSH agent forwarding (potentially other functionality as
   well) would hang due to incorrect values passed into the new window size
@@ -68,8 +142,8 @@ Changelog
   async/generator based file listings. Thanks to John Begeman.
 * :support:`378 backported` Minor code cleanup in the SSH config module
   courtesy of Olle Lundberg.
-* :support:`249` Consolidate version information into one spot. Thanks to Gabi
-  Davar for the reminder.
+* :support:`249 backported` Consolidate version information into one spot.
+  Thanks to Gabi Davar for the reminder.
 * :release:`1.14.1 <2014-08-25>`
 * :release:`1.13.2 <2014-08-25>`
 * :bug:`376` Be less aggressive about expanding variables in ``ssh_config``
diff --git a/sites/www/index.rst b/sites/www/index.rst
index 1b609709..8e7562af 100644
--- a/sites/www/index.rst
+++ b/sites/www/index.rst
@@ -26,11 +26,7 @@ Please see the sidebar to the left to begin.
 .. rubric:: Footnotes
 
 .. [#]
-    SSH is defined in RFCs
-    `4251 <http://www.rfc-editor.org/rfc/rfc4251.txt>`_,
-    `4252 <http://www.rfc-editor.org/rfc/rfc4252.txt>`_,
-    `4253 <http://www.rfc-editor.org/rfc/rfc4253.txt>`_, and 
-    `4254 <http://www.rfc-editor.org/rfc/rfc4254.txt>`_;
-    the primary working implementation of the protocol is the `OpenSSH project
+    SSH is defined in :rfc:`4251`, :rfc:`4252`, :rfc:`4253` and :rfc:`4254`. The
+    primary working implementation of the protocol is the `OpenSSH project
     <http://openssh.org>`_.  Paramiko implements a large portion of the SSH
     feature set, but there are occasional gaps.
diff --git a/tasks.py b/tasks.py
index 3503d019..7c920daf 100644
--- a/tasks.py
+++ b/tasks.py
@@ -3,28 +3,10 @@ from os.path import join
 from shutil import rmtree, copytree
 
 from invoke import Collection, ctask as task
-from invocations import docs as _docs
+from invocations.docs import docs, www
 from invocations.packaging import publish
 
 
-d = 'sites'
-
-# Usage doc/API site (published as docs.paramiko.org)
-docs_path = join(d, 'docs')
-docs_build = join(docs_path, '_build')
-docs = Collection.from_module(_docs, name='docs', config={
-    'sphinx.source': docs_path,
-    'sphinx.target': docs_build,
-})
-
-# Main/about/changelog site ((www.)?paramiko.org)
-www_path = join(d, 'www')
-www = Collection.from_module(_docs, name='www', config={
-    'sphinx.source': www_path,
-    'sphinx.target': join(www_path, '_build'),
-})
-
-
 # Until we move to spec-based testing
 @task
 def test(ctx, coverage=False):
@@ -35,6 +17,11 @@ def test(ctx, coverage=False):
     ctx.run("{0} test.py {1}".format(runner, flags), pty=True)
 
 
+@task
+def coverage(ctx):
+    ctx.run("coverage run --source=paramiko test.py --verbose")
+
+
 # Until we stop bundling docs w/ releases. Need to discover use cases first.
 @task
 def release(ctx):
@@ -43,11 +30,12 @@ def release(ctx):
     # Move the built docs into where Epydocs used to live
     target = 'docs'
     rmtree(target, ignore_errors=True)
-    copytree(docs_build, target)
+    # TODO: make it easier to yank out this config val from the docs coll
+    copytree('sites/docs/_build', target)
     # Publish
-    publish(ctx, wheel=True)
+    publish(ctx)
     # Remind
     print("\n\nDon't forget to update RTD's versions page for new minor releases!")
 
 
-ns = Collection(test, release, docs=docs, www=www)
+ns = Collection(test, coverage, release, docs, www)
diff --git a/tests/test_auth.py b/tests/test_auth.py
index 1d972d53..ec78e3ce 100644
--- a/tests/test_auth.py
+++ b/tests/test_auth.py
@@ -118,12 +118,12 @@ class AuthTest (unittest.TestCase):
         self.ts.add_server_key(host_key)
         self.event = threading.Event()
         self.server = NullServer()
-        self.assertTrue(not self.event.isSet())
+        self.assertTrue(not self.event.is_set())
         self.ts.start_server(self.event, self.server)
     
     def verify_finished(self):
         self.event.wait(1.0)
-        self.assertTrue(self.event.isSet())
+        self.assertTrue(self.event.is_set())
         self.assertTrue(self.ts.is_active())
 
     def test_1_bad_auth_type(self):
diff --git a/tests/test_client.py b/tests/test_client.py
index 28d1cb46..3d2e75c9 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -128,7 +128,7 @@ class SSHClientTest (unittest.TestCase):
 
         # Authentication successful?
         self.event.wait(1.0)
-        self.assertTrue(self.event.isSet())
+        self.assertTrue(self.event.is_set())
         self.assertTrue(self.ts.is_active())
         self.assertEqual('slowdive', self.ts.get_username())
         self.assertEqual(True, self.ts.is_authenticated())
@@ -226,7 +226,7 @@ class SSHClientTest (unittest.TestCase):
         self.tc.connect(self.addr, self.port, username='slowdive', password='pygmalion')
 
         self.event.wait(1.0)
-        self.assertTrue(self.event.isSet())
+        self.assertTrue(self.event.is_set())
         self.assertTrue(self.ts.is_active())
         self.assertEqual('slowdive', self.ts.get_username())
         self.assertEqual(True, self.ts.is_authenticated())
@@ -281,7 +281,7 @@ class SSHClientTest (unittest.TestCase):
         self.tc.connect(self.addr, self.port, username='slowdive', password='pygmalion')
 
         self.event.wait(1.0)
-        self.assertTrue(self.event.isSet())
+        self.assertTrue(self.event.is_set())
         self.assertTrue(self.ts.is_active())
 
         p = weakref.ref(self.tc._transport.packetizer)
@@ -316,7 +316,7 @@ class SSHClientTest (unittest.TestCase):
             self.tc.connect(self.addr, self.port, username='slowdive', password='pygmalion')
 
             self.event.wait(1.0)
-            self.assertTrue(self.event.isSet())
+            self.assertTrue(self.event.is_set())
             self.assertTrue(self.ts.is_active())
 
             self.assertTrue(self.tc._transport is not None)
diff --git a/tests/test_file.py b/tests/test_file.py
index 22a34aca..a6ff69e9 100755
--- a/tests/test_file.py
+++ b/tests/test_file.py
@@ -70,13 +70,17 @@ class BufferedFileTest (unittest.TestCase):
 
     def test_2_readline(self):
         f = LoopbackFile('r+U')
-        f.write(b'First line.\nSecond line.\r\nThird line.\nFinal line non-terminated.')
+        f.write(b'First line.\nSecond line.\r\nThird line.\n' + 
+                b'Fourth line.\nFinal line non-terminated.')
+        
         self.assertEqual(f.readline(), 'First line.\n')
         # universal newline mode should convert this linefeed:
         self.assertEqual(f.readline(), 'Second line.\n')
         # truncated line:
         self.assertEqual(f.readline(7), 'Third l')
         self.assertEqual(f.readline(), 'ine.\n')
+        # newline should be detected and only the fourth line returned
+        self.assertEqual(f.readline(39), 'Fourth line.\n')
         self.assertEqual(f.readline(), 'Final line non-terminated.')
         self.assertEqual(f.readline(), '')
         f.close()
diff --git a/tests/test_gssapi.py b/tests/test_gssapi.py
index a328dd65..96c268d9 100644
--- a/tests/test_gssapi.py
+++ b/tests/test_gssapi.py
@@ -27,15 +27,13 @@ import socket
 
 
 class GSSAPITest(unittest.TestCase):
-
+    @staticmethod
     def init(hostname=None, srv_mode=False):
         global krb5_mech, targ_name, server_mode
         krb5_mech = "1.2.840.113554.1.2.2"
         targ_name = hostname
         server_mode = srv_mode
 
-    init = staticmethod(init)
-
     def test_1_pyasn1(self):
         """
         Test the used methods of pyasn1.
diff --git a/tests/test_hostkeys.py b/tests/test_hostkeys.py
index 0ee1bbf0..2bdcad9c 100644
--- a/tests/test_hostkeys.py
+++ b/tests/test_hostkeys.py
@@ -31,6 +31,7 @@ test_hosts_file = """\
 secure.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1PD6U2/TVxET6lkpKhOk5r\
 9q/kAYG6sP9f5zuUYP8i7FOFp/6ncCEbbtg/lB+A3iidyxoSWl+9jtoyyDOOVX4UIDV9G11Ml8om3\
 D+jrpI9cycZHqilK0HmxDeCuxbwyMuaCygU9gS2qoRvNLWZk70OpIKSSpBo0Wl3/XUmz9uhc=
+broken.example.com ssh-rsa AAAA
 happy.example.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8bP1ZA7DCZDB9J0s50l31M\
 BGQ3GQ/Fc7SX6gkpXkwcZryoi4kNFhHu5LvHcZPdxXV1D+uTMfGS1eyd2Yz/DoNWXNAl8TI0cAsW\
 5ymME3bQ4J/k1IKxCtz/bAlAqFgKoc+EolMziDYqWIATtW0rYTJvzGAzTmMj80/QpsFH+Pc2M=
diff --git a/tests/test_kex_gss.py b/tests/test_kex_gss.py
index 8769d09c..3bf788da 100644
--- a/tests/test_kex_gss.py
+++ b/tests/test_kex_gss.py
@@ -58,14 +58,12 @@ class NullServer (paramiko.ServerInterface):
 
 
 class GSSKexTest(unittest.TestCase):
-
+    @staticmethod
     def init(username, hostname):
         global krb5_principal, targ_name
         krb5_principal = username
         targ_name = hostname
 
-    init = staticmethod(init)
-
     def setUp(self):
         self.username = krb5_principal
         self.hostname = socket.getfqdn(targ_name)
@@ -111,7 +109,7 @@ class GSSKexTest(unittest.TestCase):
                         gss_auth=True, gss_kex=True)
 
         self.event.wait(1.0)
-        self.assert_(self.event.isSet())
+        self.assert_(self.event.is_set())
         self.assert_(self.ts.is_active())
         self.assertEquals(self.username, self.ts.get_username())
         self.assertEquals(True, self.ts.is_authenticated())
diff --git a/tests/test_message.py b/tests/test_message.py
index f308c037..f18cae90 100644
--- a/tests/test_message.py
+++ b/tests/test_message.py
@@ -92,12 +92,12 @@ class MessageTest (unittest.TestCase):
 
     def test_4_misc(self):
         msg = Message(self.__d)
-        self.assertEqual(msg.get_int(), 5)
-        self.assertEqual(msg.get_int(), 0x1122334455)
-        self.assertEqual(msg.get_int(), 0xf00000000000000000)
+        self.assertEqual(msg.get_adaptive_int(), 5)
+        self.assertEqual(msg.get_adaptive_int(), 0x1122334455)
+        self.assertEqual(msg.get_adaptive_int(), 0xf00000000000000000)
         self.assertEqual(msg.get_so_far(), self.__d[:29])
         self.assertEqual(msg.get_remainder(), self.__d[29:])
         msg.rewind()
-        self.assertEqual(msg.get_int(), 5)
+        self.assertEqual(msg.get_adaptive_int(), 5)
         self.assertEqual(msg.get_so_far(), self.__d[:4])
         self.assertEqual(msg.get_remainder(), self.__d[4:])
diff --git a/tests/test_sftp.py b/tests/test_sftp.py
index 72c7ba03..cb8f7f84 100755
--- a/tests/test_sftp.py
+++ b/tests/test_sftp.py
@@ -97,7 +97,7 @@ def get_sftp():
 
 
 class SFTPTest (unittest.TestCase):
-
+    @staticmethod
     def init(hostname, username, keyfile, passwd):
         global sftp, tc
 
@@ -129,8 +129,8 @@ class SFTPTest (unittest.TestCase):
             sys.stderr.write('\n')
             sys.exit(1)
         sftp = paramiko.SFTP.from_transport(t)
-    init = staticmethod(init)
 
+    @staticmethod
     def init_loopback():
         global sftp, tc
 
@@ -150,12 +150,11 @@ class SFTPTest (unittest.TestCase):
         event.wait(1.0)
 
         sftp = paramiko.SFTP.from_transport(tc)
-    init_loopback = staticmethod(init_loopback)
 
+    @staticmethod
     def set_big_file_test(onoff):
         global g_big_file_test
         g_big_file_test = onoff
-    set_big_file_test = staticmethod(set_big_file_test)
 
     def setUp(self):
         global FOLDER
diff --git a/tests/test_ssh_gss.py b/tests/test_ssh_gss.py
index 595081b8..e20d348f 100644
--- a/tests/test_ssh_gss.py
+++ b/tests/test_ssh_gss.py
@@ -57,14 +57,12 @@ class NullServer (paramiko.ServerInterface):
 
 
 class GSSAuthTest(unittest.TestCase):
-
+    @staticmethod
     def init(username, hostname):
         global krb5_principal, targ_name
         krb5_principal = username
         targ_name = hostname
 
-    init = staticmethod(init)
-
     def setUp(self):
         self.username = krb5_principal
         self.hostname = socket.getfqdn(targ_name)
@@ -104,7 +102,7 @@ class GSSAuthTest(unittest.TestCase):
                         gss_auth=True)
 
         self.event.wait(1.0)
-        self.assert_(self.event.isSet())
+        self.assert_(self.event.is_set())
         self.assert_(self.ts.is_active())
         self.assertEquals(self.username, self.ts.get_username())
         self.assertEquals(True, self.ts.is_authenticated())
diff --git a/tests/test_transport.py b/tests/test_transport.py
index d6884e4b..80f5e611 100644
--- a/tests/test_transport.py
+++ b/tests/test_transport.py
@@ -36,7 +36,7 @@ from paramiko import Transport, SecurityOptions, ServerInterface, RSAKey, DSSKey
 from paramiko import AUTH_FAILED, AUTH_SUCCESSFUL
 from paramiko import OPEN_SUCCEEDED, OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
 from paramiko.common import MSG_KEXINIT, cMSG_CHANNEL_WINDOW_ADJUST, \
-                            MIN_PACKET_SIZE, MAX_WINDOW_SIZE, \
+                            MIN_PACKET_SIZE, MIN_WINDOW_SIZE, MAX_WINDOW_SIZE, \
                             DEFAULT_WINDOW_SIZE, DEFAULT_MAX_PACKET_SIZE
 from paramiko.py3compat import bytes
 from paramiko.message import Message
@@ -137,12 +137,12 @@ class TransportTest(unittest.TestCase):
 
         event = threading.Event()
         self.server = NullServer()
-        self.assertTrue(not event.isSet())
+        self.assertTrue(not event.is_set())
         self.ts.start_server(event, self.server)
         self.tc.connect(hostkey=public_host_key,
                         username='slowdive', password='pygmalion')
         event.wait(1.0)
-        self.assertTrue(event.isSet())
+        self.assertTrue(event.is_set())
         self.assertTrue(self.ts.is_active())
 
     def test_1_security_options(self):
@@ -181,7 +181,7 @@ class TransportTest(unittest.TestCase):
         self.ts.add_server_key(host_key)
         event = threading.Event()
         server = NullServer()
-        self.assertTrue(not event.isSet())
+        self.assertTrue(not event.is_set())
         self.assertEqual(None, self.tc.get_username())
         self.assertEqual(None, self.ts.get_username())
         self.assertEqual(False, self.tc.is_authenticated())
@@ -190,7 +190,7 @@ class TransportTest(unittest.TestCase):
         self.tc.connect(hostkey=public_host_key,
                         username='slowdive', password='pygmalion')
         event.wait(1.0)
-        self.assertTrue(event.isSet())
+        self.assertTrue(event.is_set())
         self.assertTrue(self.ts.is_active())
         self.assertEqual('slowdive', self.tc.get_username())
         self.assertEqual('slowdive', self.ts.get_username())
@@ -206,13 +206,13 @@ class TransportTest(unittest.TestCase):
         self.ts.add_server_key(host_key)
         event = threading.Event()
         server = NullServer()
-        self.assertTrue(not event.isSet())
+        self.assertTrue(not event.is_set())
         self.socks.send(LONG_BANNER)
         self.ts.start_server(event, server)
         self.tc.connect(hostkey=public_host_key,
                         username='slowdive', password='pygmalion')
         event.wait(1.0)
-        self.assertTrue(event.isSet())
+        self.assertTrue(event.is_set())
         self.assertTrue(self.ts.is_active())
 
     def test_4_special(self):
@@ -683,7 +683,7 @@ class TransportTest(unittest.TestCase):
             def run(self):
                 try:
                     for i in range(1, 1+self.iterations):
-                        if self.done_event.isSet():
+                        if self.done_event.is_set():
                             break
                         self.watchdog_event.set()
                         #print i, "SEND"
@@ -702,7 +702,7 @@ class TransportTest(unittest.TestCase):
 
             def run(self):
                 try:
-                    while not self.done_event.isSet():
+                    while not self.done_event.is_set():
                         if self.chan.recv_ready():
                             chan.recv(65536)
                             self.watchdog_event.set()
@@ -756,12 +756,12 @@ class TransportTest(unittest.TestCase):
 
         # Act as a watchdog timer, checking
         deadlocked = False
-        while not deadlocked and not done_event.isSet():
+        while not deadlocked and not done_event.is_set():
             for event in (st.watchdog_event, rt.watchdog_event):
                 event.wait(timeout)
-                if done_event.isSet():
+                if done_event.is_set():
                     break
-                if not event.isSet():
+                if not event.is_set():
                     deadlocked = True
                     break
                 event.clear()
@@ -782,7 +782,7 @@ class TransportTest(unittest.TestCase):
         """
         verify that we conform to the rfc of packet and window sizes.
         """
-        for val, correct in [(32767, MIN_PACKET_SIZE),
+        for val, correct in [(4095, MIN_PACKET_SIZE),
                              (None, DEFAULT_MAX_PACKET_SIZE),
                              (2**32, MAX_WINDOW_SIZE)]:
             self.assertEqual(self.tc._sanitize_packet_size(val), correct)
@@ -791,7 +791,24 @@ class TransportTest(unittest.TestCase):
         """
         verify that we conform to the rfc of packet and window sizes.
         """
-        for val, correct in [(32767, MIN_PACKET_SIZE),
+        for val, correct in [(32767, MIN_WINDOW_SIZE),
                              (None, DEFAULT_WINDOW_SIZE),
                              (2**32, MAX_WINDOW_SIZE)]:
             self.assertEqual(self.tc._sanitize_window_size(val), correct)
+
+    def test_L_handshake_timeout(self):
+        """
+        verify that we can get a hanshake timeout.
+        """
+        host_key = RSAKey.from_private_key_file(test_path('test_rsa.key'))
+        public_host_key = RSAKey(data=host_key.asbytes())
+        self.ts.add_server_key(host_key)
+        event = threading.Event()
+        server = NullServer()
+        self.assertTrue(not event.is_set())
+        self.tc.handshake_timeout = 0.000000000001
+        self.ts.start_server(event, server)
+        self.assertRaises(EOFError, self.tc.connect,
+                          hostkey=public_host_key,
+                          username='slowdive',
+                          password='pygmalion')
diff --git a/tests/test_util.py b/tests/test_util.py
index 7f68de21..bfdc525e 100644
--- a/tests/test_util.py
+++ b/tests/test_util.py
@@ -464,3 +464,23 @@ Host param3 parara
         assert safe_vanilla == vanilla, err.format(safe_vanilla, vanilla)
         assert safe_has_bytes == expected_bytes, \
             err.format(safe_has_bytes, expected_bytes)
+
+    def test_proxycommand_none_issue_418(self):
+        test_config_file = """
+Host proxycommand-standard-none
+    ProxyCommand None
+
+Host proxycommand-with-equals-none
+    ProxyCommand=None
+    """
+        for host, values in {
+            'proxycommand-standard-none':    {'hostname': 'proxycommand-standard-none'},
+            'proxycommand-with-equals-none': {'hostname': 'proxycommand-with-equals-none'}
+        }.items():
+
+            f = StringIO(test_config_file)
+            config = paramiko.util.parse_ssh_config(f)
+            self.assertEqual(
+                paramiko.util.lookup_ssh_host_config(host, config),
+                values
+            )