Imported Upstream version 1.12.2upstream/1.12.2

38 files changed, 677 insertions, 161 deletions

diff --git a/paramiko/__init__.py b/paramiko/__init__.py
index 099314e..648b595 100644
--- a/paramiko/__init__.py
+++ b/paramiko/__init__.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -46,6 +46,8 @@ Paramiko is written entirely in python (no C or platform-dependent code) and is
 released under the GNU Lesser General Public License (LGPL).
 
 Website: U{https://github.com/paramiko/paramiko/}
+
+Mailing list: U{paramiko@librelist.com<mailto:paramiko@librelist.com>}
 """
 
 import sys
@@ -55,7 +57,8 @@ if sys.version_info < (2, 5):
 
 
 __author__ = "Jeff Forcier <jeff@bitprophet.org>"
-__version__ = "1.10.1"
+__version__ = "1.12.2"
+__version_info__ = tuple([ int(d) for d in __version__.split(".") ])
 __license__ = "GNU Lesser General Public License (LGPL)"
 
 
@@ -69,6 +72,7 @@ from ssh_exception import SSHException, PasswordRequiredException, \
 from server import ServerInterface, SubsystemHandler, InteractiveQuery
 from rsakey import RSAKey
 from dsskey import DSSKey
+from ecdsakey import ECDSAKey
 from sftp import SFTPError, BaseSFTP
 from sftp_client import SFTP, SFTPClient
 from sftp_server import SFTPServer
diff --git a/paramiko/_winapi.py b/paramiko/_winapi.py
new file mode 100644
index 0000000..b875924
--- /dev/null
+++ b/paramiko/_winapi.py
@@ -0,0 +1,274 @@
+"""
+Windows API functions implemented as ctypes functions and classes as found
+in jaraco.windows (2.10).
+
+If you encounter issues with this module, please consider reporting the issues
+in jaraco.windows and asking the author to port the fixes back here.
+"""
+
+import ctypes
+import ctypes.wintypes
+import __builtin__
+
+try:
+        USHORT = ctypes.wintypes.USHORT
+except AttributeError:
+        USHORT = ctypes.c_ushort
+
+######################
+# jaraco.windows.error
+
+def format_system_message(errno):
+	"""
+	Call FormatMessage with a system error number to retrieve
+	the descriptive error message.
+	"""
+	# first some flags used by FormatMessageW
+	ALLOCATE_BUFFER = 0x100
+	ARGUMENT_ARRAY = 0x2000
+	FROM_HMODULE = 0x800
+	FROM_STRING = 0x400
+	FROM_SYSTEM = 0x1000
+	IGNORE_INSERTS = 0x200
+
+	# Let FormatMessageW allocate the buffer (we'll free it below)
+	# Also, let it know we want a system error message.
+	flags = ALLOCATE_BUFFER | FROM_SYSTEM
+	source = None
+	message_id = errno
+	language_id = 0
+	result_buffer = ctypes.wintypes.LPWSTR()
+	buffer_size = 0
+	arguments = None
+	bytes = ctypes.windll.kernel32.FormatMessageW(
+		flags,
+		source,
+		message_id,
+		language_id,
+		ctypes.byref(result_buffer),
+		buffer_size,
+		arguments,
+		)
+	# note the following will cause an infinite loop if GetLastError
+	#  repeatedly returns an error that cannot be formatted, although
+	#  this should not happen.
+	handle_nonzero_success(bytes)
+	message = result_buffer.value
+	ctypes.windll.kernel32.LocalFree(result_buffer)
+	return message
+
+
+class WindowsError(__builtin__.WindowsError):
+	"more info about errors at http://msdn.microsoft.com/en-us/library/ms681381(VS.85).aspx"
+
+	def __init__(self, value=None):
+		if value is None:
+			value = ctypes.windll.kernel32.GetLastError()
+		strerror = format_system_message(value)
+		super(WindowsError, self).__init__(value, strerror)
+
+	@property
+	def message(self):
+		return self.strerror
+
+	@property
+	def code(self):
+		return self.winerror
+
+	def __str__(self):
+		return self.message
+
+	def __repr__(self):
+		return '{self.__class__.__name__}({self.winerror})'.format(**vars())
+
+def handle_nonzero_success(result):
+	if result == 0:
+		raise WindowsError()
+
+
+CreateFileMapping = ctypes.windll.kernel32.CreateFileMappingW
+CreateFileMapping.argtypes = [
+	ctypes.wintypes.HANDLE,
+	ctypes.c_void_p,
+	ctypes.wintypes.DWORD,
+	ctypes.wintypes.DWORD,
+	ctypes.wintypes.DWORD,
+	ctypes.wintypes.LPWSTR,
+]
+CreateFileMapping.restype = ctypes.wintypes.HANDLE
+
+MapViewOfFile = ctypes.windll.kernel32.MapViewOfFile
+MapViewOfFile.restype = ctypes.wintypes.HANDLE
+
+class MemoryMap(object):
+	"""
+	A memory map object which can have security attributes overrideden.
+	"""
+	def __init__(self, name, length, security_attributes=None):
+		self.name = name
+		self.length = length
+		self.security_attributes = security_attributes
+		self.pos = 0
+
+	def __enter__(self):
+		p_SA = (
+			ctypes.byref(self.security_attributes)
+			if self.security_attributes else None
+		)
+		INVALID_HANDLE_VALUE = -1
+		PAGE_READWRITE = 0x4
+		FILE_MAP_WRITE = 0x2
+		filemap = ctypes.windll.kernel32.CreateFileMappingW(
+			INVALID_HANDLE_VALUE, p_SA, PAGE_READWRITE, 0, self.length,
+			unicode(self.name))
+		handle_nonzero_success(filemap)
+		if filemap == INVALID_HANDLE_VALUE:
+			raise Exception("Failed to create file mapping")
+		self.filemap = filemap
+		self.view = MapViewOfFile(filemap, FILE_MAP_WRITE, 0, 0, 0)
+		return self
+
+	def seek(self, pos):
+		self.pos = pos
+
+	def write(self, msg):
+		n = len(msg)
+		if self.pos + n >= self.length:  # A little safety.
+			raise ValueError("Refusing to write %d bytes" % n)
+		ctypes.windll.kernel32.RtlMoveMemory(self.view + self.pos, msg, n)
+		self.pos += n
+
+	def read(self, n):
+		"""
+		Read n bytes from mapped view.
+		"""
+		out = ctypes.create_string_buffer(n)
+		ctypes.windll.kernel32.RtlMoveMemory(out, self.view + self.pos, n)
+		self.pos += n
+		return out.raw
+
+	def __exit__(self, exc_type, exc_val, tb):
+		ctypes.windll.kernel32.UnmapViewOfFile(self.view)
+		ctypes.windll.kernel32.CloseHandle(self.filemap)
+
+#########################
+# jaraco.windows.security
+
+class TokenInformationClass:
+	TokenUser = 1
+
+class TOKEN_USER(ctypes.Structure):
+	num = 1
+	_fields_ = [
+		('SID', ctypes.c_void_p),
+		('ATTRIBUTES', ctypes.wintypes.DWORD),
+	]
+
+
+class SECURITY_DESCRIPTOR(ctypes.Structure):
+	"""
+	typedef struct _SECURITY_DESCRIPTOR
+		{
+		UCHAR Revision;
+		UCHAR Sbz1;
+		SECURITY_DESCRIPTOR_CONTROL Control;
+		PSID Owner;
+		PSID Group;
+		PACL Sacl;
+		PACL Dacl;
+		}   SECURITY_DESCRIPTOR;
+	"""
+	SECURITY_DESCRIPTOR_CONTROL = USHORT
+	REVISION = 1
+
+	_fields_ = [
+		('Revision', ctypes.c_ubyte),
+		('Sbz1', ctypes.c_ubyte),
+		('Control', SECURITY_DESCRIPTOR_CONTROL),
+		('Owner', ctypes.c_void_p),
+		('Group', ctypes.c_void_p),
+		('Sacl', ctypes.c_void_p),
+		('Dacl', ctypes.c_void_p),
+	]
+
+class SECURITY_ATTRIBUTES(ctypes.Structure):
+	"""
+	typedef struct _SECURITY_ATTRIBUTES {
+		DWORD  nLength;
+		LPVOID lpSecurityDescriptor;
+		BOOL   bInheritHandle;
+	} SECURITY_ATTRIBUTES;
+	"""
+	_fields_ = [
+		('nLength', ctypes.wintypes.DWORD),
+		('lpSecurityDescriptor', ctypes.c_void_p),
+		('bInheritHandle', ctypes.wintypes.BOOL),
+	]
+
+	def __init__(self, *args, **kwargs):
+		super(SECURITY_ATTRIBUTES, self).__init__(*args, **kwargs)
+		self.nLength = ctypes.sizeof(SECURITY_ATTRIBUTES)
+
+	def _get_descriptor(self):
+		return self._descriptor
+	def _set_descriptor(self, descriptor):
+		self._descriptor = descriptor
+		self.lpSecurityDescriptor = ctypes.addressof(descriptor)
+	descriptor = property(_get_descriptor, _set_descriptor)
+
+def GetTokenInformation(token, information_class):
+	"""
+	Given a token, get the token information for it.
+	"""
+	data_size = ctypes.wintypes.DWORD()
+	ctypes.windll.advapi32.GetTokenInformation(token, information_class.num,
+		0, 0, ctypes.byref(data_size))
+	data = ctypes.create_string_buffer(data_size.value)
+	handle_nonzero_success(ctypes.windll.advapi32.GetTokenInformation(token,
+		information_class.num,
+		ctypes.byref(data), ctypes.sizeof(data),
+		ctypes.byref(data_size)))
+	return ctypes.cast(data, ctypes.POINTER(TOKEN_USER)).contents
+
+class TokenAccess:
+	TOKEN_QUERY = 0x8
+
+def OpenProcessToken(proc_handle, access):
+	result = ctypes.wintypes.HANDLE()
+	proc_handle = ctypes.wintypes.HANDLE(proc_handle)
+	handle_nonzero_success(ctypes.windll.advapi32.OpenProcessToken(
+		proc_handle, access, ctypes.byref(result)))
+	return result
+
+def get_current_user():
+	"""
+	Return a TOKEN_USER for the owner of this process.
+	"""
+	process = OpenProcessToken(
+		ctypes.windll.kernel32.GetCurrentProcess(),
+		TokenAccess.TOKEN_QUERY,
+	)
+	return GetTokenInformation(process, TOKEN_USER)
+
+def get_security_attributes_for_user(user=None):
+	"""
+	Return a SECURITY_ATTRIBUTES structure with the SID set to the
+	specified user (uses current user if none is specified).
+	"""
+	if user is None:
+		user = get_current_user()
+
+	assert isinstance(user, TOKEN_USER), "user must be TOKEN_USER instance"
+
+	SD = SECURITY_DESCRIPTOR()
+	SA = SECURITY_ATTRIBUTES()
+	# by attaching the actual security descriptor, it will be garbage-
+	# collected with the security attributes
+	SA.descriptor = SD
+	SA.bInheritHandle = 1
+
+	ctypes.windll.advapi32.InitializeSecurityDescriptor(ctypes.byref(SD),
+		SECURITY_DESCRIPTOR.REVISION)
+	ctypes.windll.advapi32.SetSecurityDescriptorOwner(ctypes.byref(SD),
+		user.SID, 0)
+	return SA
diff --git a/paramiko/agent.py b/paramiko/agent.py
index 1dd3063..23a5a2e 100644
--- a/paramiko/agent.py
+++ b/paramiko/agent.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -255,11 +255,11 @@ class AgentServerProxy(AgentSSH):
         self.close()
 
     def connect(self):
-         conn_sock = self.__t.open_forward_agent_channel()
-         if conn_sock is None:
-             raise SSHException('lost ssh-agent')
-         conn_sock.set_name('auth-agent')
-         self._connect(conn_sock)
+        conn_sock = self.__t.open_forward_agent_channel()
+        if conn_sock is None:
+            raise SSHException('lost ssh-agent')
+        conn_sock.set_name('auth-agent')
+        self._connect(conn_sock)
 
     def close(self):
         """
diff --git a/paramiko/auth_handler.py b/paramiko/auth_handler.py
index e3bd82d..acb7c8b 100644
--- a/paramiko/auth_handler.py
+++ b/paramiko/auth_handler.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/ber.py b/paramiko/ber.py
index 19568dd..3941581 100644
--- a/paramiko/ber.py
+++ b/paramiko/ber.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/buffered_pipe.py b/paramiko/buffered_pipe.py
index b19d74b..4ef5cf7 100644
--- a/paramiko/buffered_pipe.py
+++ b/paramiko/buffered_pipe.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/channel.py b/paramiko/channel.py
index 0c603c6..d1e6333 100644
--- a/paramiko/channel.py
+++ b/paramiko/channel.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -1027,6 +1027,13 @@ class Channel (object):
                 ok = False
             else:
                 ok = server.check_channel_shell_request(self)
+        elif key == 'env':
+            name = m.get_string()
+            value = m.get_string()
+            if server is None:
+                ok = False
+            else:
+                ok = server.check_channel_env_request(self, name, value)
         elif key == 'exec':
             cmd = m.get_string()
             if server is None:
diff --git a/paramiko/client.py b/paramiko/client.py
index 5b71958..be89609 100644
--- a/paramiko/client.py
+++ b/paramiko/client.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -186,8 +186,13 @@ class SSHClient (object):
 
         @raise IOError: if the file could not be written
         """
+
+        # update local host keys from file (in case other SSH clients
+        # have written to the known_hosts file meanwhile.
+        if self._host_keys_filename is not None:
+            self.load_host_keys(self._host_keys_filename)
+
         f = open(filename, 'w')
-        f.write('# SSH host keys collected by paramiko\n')
         for hostname, keys in self._host_keys.iteritems():
             for keytype, key in keys.iteritems():
                 f.write('%s %s %s\n' % (hostname, keytype, key.get_base64()))
diff --git a/paramiko/common.py b/paramiko/common.py
index 25d5457..3d7ca58 100644
--- a/paramiko/common.py
+++ b/paramiko/common.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/compress.py b/paramiko/compress.py
index 40b430f..b55f0b1 100644
--- a/paramiko/compress.py
+++ b/paramiko/compress.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/config.py b/paramiko/config.py
index e41bae4..1705de7 100644
--- a/paramiko/config.py
+++ b/paramiko/config.py
@@ -8,7 +8,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -35,9 +35,10 @@ class LazyFqdn(object):
     Returns the host's fqdn on request as string.
     """
 
-    def __init__(self, config):
+    def __init__(self, config, host=None):
         self.fqdn = None
         self.config = config
+        self.host = host
 
     def __str__(self):
         if self.fqdn is None:
@@ -54,19 +55,27 @@ class LazyFqdn(object):
             fqdn = None
             address_family = self.config.get('addressfamily', 'any').lower()
             if address_family != 'any':
-                family = socket.AF_INET if address_family == 'inet' \
-                    else socket.AF_INET6
-                results = socket.getaddrinfo(host,
-                                             None,
-                                             family,
-                                             socket.SOCK_DGRAM,
-                                             socket.IPPROTO_IP,
-                                             socket.AI_CANONNAME)
-                for res in results:
-                    af, socktype, proto, canonname, sa = res
-                    if canonname and '.' in canonname:
-                        fqdn = canonname
-                        break
+                try:
+                    family = socket.AF_INET if address_family == 'inet' \
+                        else socket.AF_INET6
+                    results = socket.getaddrinfo(
+                        self.host,
+                        None,
+                        family,
+                        socket.SOCK_DGRAM,
+                        socket.IPPROTO_IP,
+                        socket.AI_CANONNAME
+                    )
+                    for res in results:
+                        af, socktype, proto, canonname, sa = res
+                        if canonname and '.' in canonname:
+                            fqdn = canonname
+                            break
+                # giaerror -> socket.getaddrinfo() can't resolve self.host
+                # (which is from socket.gethostname()). Fall back to the
+                # getfqdn() call below.
+                except socket.gaierror:
+                    pass
             # Handle 'any' / unspecified
             if fqdn is None:
                 fqdn = socket.getfqdn()
@@ -126,16 +135,17 @@ class SSHConfig (object):
                 self._config.append(host)
                 value = value.split()
                 host = {key: value, 'config': {}}
-            #identityfile is a special case, since it is allowed to be
+            #identityfile, localforward, remoteforward keys are special cases, since they are allowed to be
             # specified multiple times and they should be tried in order
             # of specification.
-            elif key == 'identityfile':
+            
+            elif key in ['identityfile', 'localforward', 'remoteforward']:
                 if key in host['config']:
-                    host['config']['identityfile'].append(value)
+                    host['config'][key].append(value)
                 else:
-                    host['config']['identityfile'] = [value]
+                    host['config'][key] = [value]
             elif key not in host['config']:
-                    host['config'].update({key: value})
+                host['config'].update({key: value})
         self._config.append(host)
 
     def lookup(self, hostname):
@@ -215,7 +225,7 @@ class SSHConfig (object):
             remoteuser = user
 
         host = socket.gethostname().split('.')[0]
-        fqdn = LazyFqdn(config)
+        fqdn = LazyFqdn(config, host)
         homedir = os.path.expanduser('~')
         replacements = {'controlpath':
                         [
@@ -252,5 +262,5 @@ class SSHConfig (object):
                             config[k][item] = config[k][item].\
                                 replace(find, str(replace))
                     else:
-                            config[k] = config[k].replace(find, str(replace))
+                        config[k] = config[k].replace(find, str(replace))
         return config
diff --git a/paramiko/dsskey.py b/paramiko/dsskey.py
index 53ca92b..f6ecb2a 100644
--- a/paramiko/dsskey.py
+++ b/paramiko/dsskey.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/ecdsakey.py b/paramiko/ecdsakey.py
new file mode 100644
index 0000000..ac840ab
--- /dev/null
+++ b/paramiko/ecdsakey.py
@@ -0,0 +1,181 @@
+# Copyright (C) 2003-2007  Robey Pointer <robeypointer@gmail.com>
+#
+# This file is part of paramiko.
+#
+# Paramiko is free software; you can redistribute it and/or modify it under the
+# terms of the GNU Lesser General Public License as published by the Free
+# Software Foundation; either version 2.1 of the License, or (at your option)
+# any later version.
+#
+# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with Paramiko; if not, write to the Free Software Foundation, Inc.,
+# 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA.
+
+"""
+L{ECDSAKey}
+"""
+
+import binascii
+from ecdsa import SigningKey, VerifyingKey, der, curves
+from ecdsa.util import number_to_string, sigencode_string, sigencode_strings, sigdecode_strings
+from Crypto.Hash import SHA256, MD5
+from Crypto.Cipher import DES3
+
+from paramiko.common import *
+from paramiko import util
+from paramiko.message import Message
+from paramiko.ber import BER, BERException
+from paramiko.pkey import PKey
+from paramiko.ssh_exception import SSHException
+
+
+class ECDSAKey (PKey):
+    """
+    Representation of an ECDSA key which can be used to sign and verify SSH2
+    data.
+    """
+
+    def __init__(self, msg=None, data=None, filename=None, password=None, vals=None, file_obj=None):
+        self.verifying_key = None
+        self.signing_key = None
+        if file_obj is not None:
+            self._from_private_key(file_obj, password)
+            return
+        if filename is not None:
+            self._from_private_key_file(filename, password)
+            return
+        if (msg is None) and (data is not None):
+            msg = Message(data)
+        if vals is not None:
+            self.verifying_key, self.signing_key = vals
+        else:
+            if msg is None:
+                raise SSHException('Key object may not be empty')
+            if msg.get_string() != 'ecdsa-sha2-nistp256':
+                raise SSHException('Invalid key')
+            curvename = msg.get_string()
+            if curvename != 'nistp256':
+                raise SSHException("Can't handle curve of type %s" % curvename)
+
+            pointinfo = msg.get_string()
+            if pointinfo[0] != "\x04":
+                raise SSHException('Point compression is being used: %s'%
+                                   binascii.hexlify(pointinfo))
+            self.verifying_key = VerifyingKey.from_string(pointinfo[1:],
+                curve=curves.NIST256p)
+        self.size = 256
+
+    def __str__(self):
+        key = self.verifying_key
+        m = Message()
+        m.add_string('ecdsa-sha2-nistp256')
+        m.add_string('nistp256')
+
+        point_str = "\x04" + key.to_string()
+
+        m.add_string(point_str)
+        return str(m)
+
+    def __hash__(self):
+        h = hash(self.get_name())
+        h = h * 37 + hash(self.verifying_key.pubkey.point.x())
+        h = h * 37 + hash(self.verifying_key.pubkey.point.y())
+        return hash(h)
+
+    def get_name(self):
+        return 'ecdsa-sha2-nistp256'
+
+    def get_bits(self):
+        return self.size
+
+    def can_sign(self):
+        return self.signing_key is not None
+
+    def sign_ssh_data(self, rpool, data):
+        digest = SHA256.new(data).digest()
+        sig = self.signing_key.sign_digest(digest, entropy=rpool.read,
+                                           sigencode=self._sigencode)
+        m = Message()
+        m.add_string('ecdsa-sha2-nistp256')
+        m.add_string(sig)
+        return m
+
+    def verify_ssh_sig(self, data, msg):
+        if msg.get_string() != 'ecdsa-sha2-nistp256':
+            return False
+        sig = msg.get_string()
+
+        # verify the signature by SHA'ing the data and encrypting it
+        # using the public key.
+        hash_obj = SHA256.new(data).digest()
+        return self.verifying_key.verify_digest(sig, hash_obj,
+                                                sigdecode=self._sigdecode)
+
+    def write_private_key_file(self, filename, password=None):
+        key = self.signing_key or self.verifying_key
+        self._write_private_key_file('EC', filename, key.to_der(), password)
+
+    def write_private_key(self, file_obj, password=None):
+        key = self.signing_key or self.verifying_key
+        self._write_private_key('EC', file_obj, key.to_der(), password)
+
+    def generate(bits, progress_func=None):
+        """
+        Generate a new private RSA key.  This factory function can be used to
+        generate a new host key or authentication key.
+
+        @param bits: number of bits the generated key should be.
+        @type bits: int
+        @param progress_func: an optional function to call at key points in
+            key generation (used by C{pyCrypto.PublicKey}).
+        @type progress_func: function
+        @return: new private key
+        @rtype: L{RSAKey}
+        """
+        signing_key = ECDSA.generate()
+        key = ECDSAKey(vals=(signing_key, signing_key.get_verifying_key()))
+        return key
+    generate = staticmethod(generate)
+
+
+    ###  internals...
+
+
+    def _from_private_key_file(self, filename, password):
+        data = self._read_private_key_file('EC', filename, password)
+        self._decode_key(data)
+
+    def _from_private_key(self, file_obj, password):
+        data = self._read_private_key('EC', file_obj, password)
+        self._decode_key(data)
+
+    ALLOWED_PADDINGS = ['\x01', '\x02\x02', '\x03\x03\x03', '\x04\x04\x04\x04',
+                        '\x05\x05\x05\x05\x05', '\x06\x06\x06\x06\x06\x06',
+                        '\x07\x07\x07\x07\x07\x07\x07']
+    def _decode_key(self, data):
+        s, padding = der.remove_sequence(data)
+        if padding:
+            if padding not in self.ALLOWED_PADDINGS:
+                raise ValueError, "weird padding: %s" % (binascii.hexlify(empty))
+            data = data[:-len(padding)]
+        key = SigningKey.from_der(data)
+        self.signing_key = key
+        self.verifying_key = key.get_verifying_key()
+        self.size = 256
+
+    def _sigencode(self, r, s, order):
+        msg = Message()
+        msg.add_mpint(r)
+        msg.add_mpint(s)
+        return str(msg)
+
+    def _sigdecode(self, sig, order):
+        msg = Message(sig)
+        r = msg.get_mpint()
+        s = msg.get_mpint()
+        return (r, s)
diff --git a/paramiko/file.py b/paramiko/file.py
index 7e2904e..5fd81cf 100644
--- a/paramiko/file.py
+++ b/paramiko/file.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/hostkeys.py b/paramiko/hostkeys.py
index e739312..9bcf0d5 100644
--- a/paramiko/hostkeys.py
+++ b/paramiko/hostkeys.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -28,6 +28,8 @@ import UserDict
 from paramiko.common import *
 from paramiko.dsskey import DSSKey
 from paramiko.rsakey import RSAKey
+from paramiko.util import get_logger
+from paramiko.ecdsakey import ECDSAKey
 
 
 class InvalidHostKey(Exception):
@@ -48,7 +50,7 @@ class HostKeyEntry:
         self.hostnames = hostnames
         self.key = key
 
-    def from_line(cls, line):
+    def from_line(cls, line, lineno=None):
         """
         Parses the given line of text to find the names for the host,
         the type of key, and the key data. The line is expected to be in the
@@ -61,9 +63,12 @@ class HostKeyEntry:
         @param line: a line from an OpenSSH known_hosts file
         @type line: str
         """
+        log = get_logger('paramiko.hostkeys')
         fields = line.split(' ')
         if len(fields) < 3:
             # Bad number of fields
+            log.info("Not enough fields found in known_hosts in line %s (%r)" %
+                     (lineno, line))
             return None
         fields = fields[:3]
 
@@ -77,8 +82,12 @@ class HostKeyEntry:
                 key = RSAKey(data=base64.decodestring(key))
             elif keytype == 'ssh-dss':
                 key = DSSKey(data=base64.decodestring(key))
+            elif keytype == 'ecdsa-sha2-nistp256':
+                key = ECDSAKey(data=base64.decodestring(key))
             else:
+                log.info("Unable to handle key of type %s" % (keytype,))
                 return None
+
         except binascii.Error, e:
             raise InvalidHostKey(line, e)
 
@@ -160,13 +169,18 @@ class HostKeys (UserDict.DictMixin):
         @raise IOError: if there was an error reading the file
         """
         f = open(filename, 'r')
-        for line in f:
+        for lineno, line in enumerate(f):
             line = line.strip()
             if (len(line) == 0) or (line[0] == '#'):
                 continue
-            e = HostKeyEntry.from_line(line)
+            e = HostKeyEntry.from_line(line, lineno)
             if e is not None:
-                self._entries.append(e)
+                _hostnames = e.hostnames
+                for h in _hostnames:
+                    if self.check(h, e.key):
+                        e.hostnames.remove(h)
+                if len(e.hostnames):
+                    self._entries.append(e)
         f.close()
 
     def save(self, filename):
diff --git a/paramiko/kex_gex.py b/paramiko/kex_gex.py
index 9c98339..c0455a1 100644
--- a/paramiko/kex_gex.py
+++ b/paramiko/kex_gex.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/kex_group1.py b/paramiko/kex_group1.py
index 1386cf3..6e89b6d 100644
--- a/paramiko/kex_group1.py
+++ b/paramiko/kex_group1.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/logging22.py b/paramiko/logging22.py
index ed1d891..e68c52c 100644
--- a/paramiko/logging22.py
+++ b/paramiko/logging22.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/message.py b/paramiko/message.py
index 47acc34..c0e8692 100644
--- a/paramiko/message.py
+++ b/paramiko/message.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/packet.py b/paramiko/packet.py
index 38a6d4b..6ab7363 100644
--- a/paramiko/packet.py
+++ b/paramiko/packet.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -33,17 +33,13 @@ from paramiko.ssh_exception import SSHException, ProxyCommandFailure
 from paramiko.message import Message
 
 
-got_r_hmac = False
 try:
-    import r_hmac
-    got_r_hmac = True
+    from r_hmac import HMAC
 except ImportError:
-    pass
+    from Crypto.Hash.HMAC import HMAC
+
 def compute_hmac(key, message, digest_class):
-    if got_r_hmac:
-        return r_hmac.HMAC(key, message, digest_class).digest()
-    from Crypto.Hash import HMAC
-    return HMAC.HMAC(key, message, digest_class).digest()
+    return HMAC(key, message, digest_class).digest()
 
 
 class NeedRekeyException (Exception):
@@ -156,7 +152,6 @@ class Packetizer (object):
 
     def close(self):
         self.__closed = True
-        self.__socket.close()
 
     def set_hexdump(self, hexdump):
         self.__dump_packets = hexdump
diff --git a/paramiko/pipe.py b/paramiko/pipe.py
index 37191ef..db43d54 100644
--- a/paramiko/pipe.py
+++ b/paramiko/pipe.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/pkey.py b/paramiko/pkey.py
index 3e71222..b1199df 100644
--- a/paramiko/pkey.py
+++ b/paramiko/pkey.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/primes.py b/paramiko/primes.py
index 9ebfec1..9419cd6 100644
--- a/paramiko/primes.py
+++ b/paramiko/primes.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/proxy.py b/paramiko/proxy.py
index 218b76e..3f5c8bb 100644
--- a/paramiko/proxy.py
+++ b/paramiko/proxy.py
@@ -20,10 +20,13 @@
 L{ProxyCommand}.
 """
 
+from datetime import datetime
 import os
 from shlex import split as shlsplit
 import signal
 from subprocess import Popen, PIPE
+from select import select
+import socket
 
 from paramiko.ssh_exception import ProxyCommandFailure
 
@@ -48,6 +51,8 @@ class ProxyCommand(object):
         """
         self.cmd = shlsplit(command_line)
         self.process = Popen(self.cmd, stdin=PIPE, stdout=PIPE, stderr=PIPE)
+        self.timeout = None
+        self.buffer = []
 
     def send(self, content):
         """
@@ -64,7 +69,7 @@ class ProxyCommand(object):
             # died and we can't proceed. The best option here is to
             # raise an exception informing the user that the informed
             # ProxyCommand is not working.
-            raise BadProxyCommand(' '.join(self.cmd), e.strerror)
+            raise ProxyCommandFailure(' '.join(self.cmd), e.strerror)
         return len(content)
 
     def recv(self, size):
@@ -78,14 +83,30 @@ class ProxyCommand(object):
         @rtype: int
         """
         try:
-            return os.read(self.process.stdout.fileno(), size)
+            start = datetime.now()
+            while len(self.buffer) < size:
+                if self.timeout is not None:
+                    elapsed = (datetime.now() - start).microseconds
+                    timeout = self.timeout * 1000 * 1000 # to microseconds
+                    if elapsed >= timeout:
+                        raise socket.timeout()
+                r, w, x = select([self.process.stdout], [], [], 0.0)
+                if r and r[0] == self.process.stdout:
+                    b = os.read(self.process.stdout.fileno(), 1)
+                    # Store in class-level buffer for persistence across
+                    # timeouts; this makes us act more like a real socket
+                    # (where timeouts don't actually drop data.)
+                    self.buffer.append(b)
+            result = ''.join(self.buffer)
+            self.buffer = []
+            return result
+        except socket.timeout:
+            raise # socket.timeout is a subclass of IOError
         except IOError, e:
-            raise BadProxyCommand(' '.join(self.cmd), e.strerror)
+            raise ProxyCommandFailure(' '.join(self.cmd), e.strerror)
 
     def close(self):
         os.kill(self.process.pid, signal.SIGTERM)
 
     def settimeout(self, timeout):
-        # Timeouts are meaningless for this implementation, but are part of the
-        # spec, so must be present.
-        pass
+        self.timeout = timeout
diff --git a/paramiko/resource.py b/paramiko/resource.py
index 0d5c82f..6ef86d8 100644
--- a/paramiko/resource.py
+++ b/paramiko/resource.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/rsakey.py b/paramiko/rsakey.py
index 1e2d8f9..c7500f8 100644
--- a/paramiko/rsakey.py
+++ b/paramiko/rsakey.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/server.py b/paramiko/server.py
index dac9bf1..fdb4094 100644
--- a/paramiko/server.py
+++ b/paramiko/server.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -550,6 +550,27 @@ class ServerInterface (object):
         """
         return OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
 
+    def check_channel_env_request(self, channel, name, value):
+        """
+        Check whether a given environment variable can be specified for the
+        given channel.  This method should return C{True} if the server
+        is willing to set the specified environment variable.  Note that
+        some environment variables (e.g., PATH) can be exceedingly
+        dangerous, so blindly allowing the client to set the environment
+        is almost certainly not a good idea.
+
+        The default implementation always returns C{False}.
+
+        @param channel: the L{Channel} the env request arrived on
+        @type channel: L{Channel}
+        @param name: foo bar baz
+        @type name: str
+        @param value: flklj
+        @type value: str
+        @rtype: bool
+        """
+        return False
+
 
 class SubsystemHandler (threading.Thread):
     """
diff --git a/paramiko/sftp.py b/paramiko/sftp.py
index a0b08e0..a97c300 100644
--- a/paramiko/sftp.py
+++ b/paramiko/sftp.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/sftp_attr.py b/paramiko/sftp_attr.py
index 1f09421..b459b04 100644
--- a/paramiko/sftp_attr.py
+++ b/paramiko/sftp_attr.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/sftp_client.py b/paramiko/sftp_client.py
index 17ea493..cf94582 100644
--- a/paramiko/sftp_client.py
+++ b/paramiko/sftp_client.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -736,7 +736,7 @@ class SFTPClient (BaseSFTP):
                     self._convert_status(msg)
                 return t, msg
             if fileobj is not type(None):
-                fileobj._async_response(t, msg)
+                fileobj._async_response(t, msg, num)
             if waitfor is None:
                 # just doing a single check
                 break
diff --git a/paramiko/sftp_file.py b/paramiko/sftp_file.py
index e056d70..a39b1f4 100644
--- a/paramiko/sftp_file.py
+++ b/paramiko/sftp_file.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -20,6 +20,8 @@
 L{SFTPFile}
 """
 
+from __future__ import with_statement
+
 from binascii import hexlify
 from collections import deque
 import socket
@@ -53,7 +55,8 @@ class SFTPFile (BufferedFile):
         self._prefetching = False
         self._prefetch_done = False
         self._prefetch_data = {}
-        self._prefetch_reads = []
+        self._prefetch_extents = {}
+        self._prefetch_lock = threading.Lock()
         self._saved_exception = None
         self._reqs = deque()
 
@@ -91,7 +94,7 @@ class SFTPFile (BufferedFile):
             pass
 
     def _data_in_prefetch_requests(self, offset, size):
-        k = [i for i in self._prefetch_reads if i[0] <= offset]
+        k = [x for x in self._prefetch_extents.values() if x[0] <= offset]
         if len(k) == 0:
             return False
         k.sort(lambda x, y: cmp(x[0], y[0]))
@@ -447,7 +450,6 @@ class SFTPFile (BufferedFile):
     def _start_prefetch(self, chunks):
         self._prefetching = True
         self._prefetch_done = False
-        self._prefetch_reads.extend(chunks)
 
         t = threading.Thread(target=self._prefetch_thread, args=(chunks,))
         t.setDaemon(True)
@@ -457,9 +459,11 @@ class SFTPFile (BufferedFile):
         # do these read requests in a temporary thread because there may be
         # a lot of them, so it may block.
         for offset, length in chunks:
-            self.sftp._async_request(self, CMD_READ, self.handle, long(offset), int(length))
+            with self._prefetch_lock:
+                num = self.sftp._async_request(self, CMD_READ, self.handle, long(offset), int(length))
+                self._prefetch_extents[num] = (offset, length)
 
-    def _async_response(self, t, msg):
+    def _async_response(self, t, msg, num):
         if t == CMD_STATUS:
             # save exception and re-raise it on next file operation
             try:
@@ -470,10 +474,12 @@ class SFTPFile (BufferedFile):
         if t != CMD_DATA:
             raise SFTPError('Expected data')
         data = msg.get_string()
-        offset, length = self._prefetch_reads.pop(0)
-        self._prefetch_data[offset] = data
-        if len(self._prefetch_reads) == 0:
-            self._prefetch_done = True
+        with self._prefetch_lock:
+            offset, length = self._prefetch_extents[num]
+            self._prefetch_data[offset] = data
+            del self._prefetch_extents[num]
+            if len(self._prefetch_extents) == 0:
+                self._prefetch_done = True
     
     def _check_exception(self):
         "if there's a saved exception, raise & clear it"
diff --git a/paramiko/sftp_handle.py b/paramiko/sftp_handle.py
index a6cd44a..29d3d0d 100644
--- a/paramiko/sftp_handle.py
+++ b/paramiko/sftp_handle.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/sftp_server.py b/paramiko/sftp_server.py
index 7cc6c0c..1833c2e 100644
--- a/paramiko/sftp_server.py
+++ b/paramiko/sftp_server.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/sftp_si.py b/paramiko/sftp_si.py
index 401a4e9..b0ee3c4 100644
--- a/paramiko/sftp_si.py
+++ b/paramiko/sftp_si.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/ssh_exception.py b/paramiko/ssh_exception.py
index f2406dc..b502b56 100644
--- a/paramiko/ssh_exception.py
+++ b/paramiko/ssh_exception.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/transport.py b/paramiko/transport.py
index fd6dab7..b536175 100644
--- a/paramiko/transport.py
+++ b/paramiko/transport.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -42,6 +42,7 @@ from paramiko.message import Message
 from paramiko.packet import Packetizer, NeedRekeyException
 from paramiko.primes import ModulusPack
 from paramiko.rsakey import RSAKey
+from paramiko.ecdsakey import ECDSAKey
 from paramiko.server import ServerInterface
 from paramiko.sftp_client import SFTPClient
 from paramiko.ssh_exception import (SSHException, BadAuthenticationType,
@@ -202,7 +203,7 @@ class Transport (threading.Thread):
     _preferred_ciphers = ( 'aes128-ctr', 'aes256-ctr', 'aes128-cbc', 'blowfish-cbc', 'aes256-cbc', '3des-cbc',
         'arcfour128', 'arcfour256' )
     _preferred_macs = ( 'hmac-sha1', 'hmac-md5', 'hmac-sha1-96', 'hmac-md5-96' )
-    _preferred_keys = ( 'ssh-rsa', 'ssh-dss' )
+    _preferred_keys = ( 'ssh-rsa', 'ssh-dss', 'ecdsa-sha2-nistp256' )
     _preferred_kex = ( 'diffie-hellman-group1-sha1', 'diffie-hellman-group-exchange-sha1' )
     _preferred_compression = ( 'none', )
 
@@ -227,6 +228,7 @@ class Transport (threading.Thread):
     _key_info = {
         'ssh-rsa': RSAKey,
         'ssh-dss': DSSKey,
+        'ecdsa-sha2-nistp256': ECDSAKey,
         }
 
     _kex_info = {
@@ -400,7 +402,6 @@ class Transport (threading.Thread):
 
         @since: 1.5.3
         """
-        self.sock.close()
         self.close()
 
     def get_security_options(self):
@@ -614,11 +615,10 @@ class Transport (threading.Thread):
         """
         if not self.active:
             return
-        self.active = False
-        self.packetizer.close()
-        self.join()
+        self.stop_thread()
         for chan in self._channels.values():
             chan._unlink()
+        self.sock.close()
 
     def get_remote_server_key(self):
         """
@@ -1391,6 +1391,8 @@ class Transport (threading.Thread):
     def stop_thread(self):
         self.active = False
         self.packetizer.close()
+        while self.isAlive():
+            self.join(10)
 
 
     ###  internals...
@@ -1439,7 +1441,7 @@ class Transport (threading.Thread):
                 break
             self.clear_to_send_lock.release()
             if time.time() > start + self.clear_to_send_timeout:
-              raise SSHException('Key-exchange timed out waiting for key negotiation')
+                raise SSHException('Key-exchange timed out waiting for key negotiation')
         try:
             self._send_message(data)
         finally:
@@ -1539,10 +1541,6 @@ class Transport (threading.Thread):
         # containers.
         Random.atfork()
 
-        # Hold reference to 'sys' so we can test sys.modules to detect
-        # interpreter shutdown.
-        self.sys = sys
-
         # active=True occurs before the thread is launched, to avoid a race
         _active_threads.append(self)
         if self.server_mode:
@@ -1612,7 +1610,10 @@ class Transport (threading.Thread):
                 self.saved_exception = e
             except socket.error, e:
                 if type(e.args) is tuple:
-                    emsg = '%s (%d)' % (e.args[1], e.args[0])
+                    if e.args:
+                        emsg = '%s (%d)' % (e.args[1], e.args[0])
+                    else: # empty tuple, e.g. socket.timeout
+                        emsg = str(e) or repr(e)
                 else:
                     emsg = e.args
                 self._log(ERROR, 'Socket exception: ' + emsg)
diff --git a/paramiko/util.py b/paramiko/util.py
index f4bfbec..85ee6b0 100644
--- a/paramiko/util.py
+++ b/paramiko/util.py
@@ -7,7 +7,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
diff --git a/paramiko/win_pageant.py b/paramiko/win_pageant.py
index d77d58f..d588e81 100644
--- a/paramiko/win_pageant.py
+++ b/paramiko/win_pageant.py
@@ -8,7 +8,7 @@
 # Software Foundation; either version 2.1 of the License, or (at your option)
 # any later version.
 #
-# Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY
+# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
 # details.
@@ -21,28 +21,20 @@
 Functions for communicating with Pageant, the basic windows ssh agent program.
 """
 
-import os
-import struct
-import tempfile
-import mmap
+from __future__ import with_statement
+
 import array
-import platform
 import ctypes.wintypes
+import platform
+import struct
 
-# if you're on windows, you should have one of these, i guess?
-# ctypes is part of standard library since Python 2.5
-_has_win32all = False
-_has_ctypes = False
 try:
-    # win32gui is preferred over win32ui to avoid MFC dependencies
-    import win32gui
-    _has_win32all = True
+    import _thread as thread # Python 3.x
 except ImportError:
-    try:
-        import ctypes
-        _has_ctypes = True
-    except ImportError:
-        pass
+    import thread # Python 2.5-2.7
+
+from . import _winapi
+
 
 _AGENT_COPYDATA_ID = 0x804e50ba
 _AGENT_MAX_MSGLEN = 8192
@@ -52,16 +44,7 @@ win32con_WM_COPYDATA = 74
 
 
 def _get_pageant_window_object():
-    if _has_win32all:
-        try:
-            hwnd = win32gui.FindWindow('Pageant', 'Pageant')
-            return hwnd
-        except win32gui.error:
-            pass
-    elif _has_ctypes:
-        # Return 0 if there is no Pageant window.
-        return ctypes.windll.user32.FindWindowA('Pageant', 'Pageant')
-    return None
+    return ctypes.windll.user32.FindWindowA('Pageant', 'Pageant')
 
 
 def can_talk_to_agent():
@@ -71,11 +54,12 @@ def can_talk_to_agent():
     This checks both if we have the required libraries (win32all or ctypes)
     and if there is a Pageant currently running.
     """
-    if (_has_win32all or _has_ctypes) and _get_pageant_window_object():
-        return True
-    return False
+    return bool(_get_pageant_window_object())
+
 
 ULONG_PTR = ctypes.c_uint64 if platform.architecture()[0] == '64bit' else ctypes.c_uint32
+
+
 class COPYDATASTRUCT(ctypes.Structure):
     """
     ctypes implementation of
@@ -85,53 +69,46 @@ class COPYDATASTRUCT(ctypes.Structure):
         ('num_data', ULONG_PTR),
         ('data_size', ctypes.wintypes.DWORD),
         ('data_loc', ctypes.c_void_p),
-        ]
+    ]
+
 
 def _query_pageant(msg):
+    """
+    Communication with the Pageant process is done through a shared
+    memory-mapped file.
+    """
     hwnd = _get_pageant_window_object()
     if not hwnd:
         # Raise a failure to connect exception, pageant isn't running anymore!
         return None
 
-    # Write our pageant request string into the file (pageant will read this to determine what to do)
-    filename = tempfile.mktemp('.pag')
-    map_filename = os.path.basename(filename)
-
-    f = open(filename, 'w+b')
-    f.write(msg )
-    # Ensure the rest of the file is empty, otherwise pageant will read this
-    f.write('\0' * (_AGENT_MAX_MSGLEN - len(msg)))
-    # Create the shared file map that pageant will use to read from
-    pymap = mmap.mmap(f.fileno(), _AGENT_MAX_MSGLEN, tagname=map_filename, access=mmap.ACCESS_WRITE)
-    try:
+    # create a name for the mmap
+    map_name = 'PageantRequest%08x' % thread.get_ident()
+
+    pymap = _winapi.MemoryMap(map_name, _AGENT_MAX_MSGLEN,
+        _winapi.get_security_attributes_for_user(),
+        )
+    with pymap:
+        pymap.write(msg)
         # Create an array buffer containing the mapped filename
-        char_buffer = array.array("c", map_filename + '\0')
+        char_buffer = array.array("c", map_name + '\0')
         char_buffer_address, char_buffer_size = char_buffer.buffer_info()
         # Create a string to use for the SendMessage function call
-        cds = COPYDATASTRUCT(_AGENT_COPYDATA_ID, char_buffer_size, char_buffer_address)
+        cds = COPYDATASTRUCT(_AGENT_COPYDATA_ID, char_buffer_size,
+            char_buffer_address)
 
-        if _has_win32all:
-            # win32gui.SendMessage should also allow the same pattern as
-            # ctypes, but let's keep it like this for now...
-            response = win32gui.SendMessage(hwnd, win32con_WM_COPYDATA, ctypes.sizeof(cds), ctypes.addressof(cds))
-        elif _has_ctypes:
-            response = ctypes.windll.user32.SendMessageA(hwnd, win32con_WM_COPYDATA, ctypes.sizeof(cds), ctypes.byref(cds))
-        else:
-            response = 0
+        response = ctypes.windll.user32.SendMessageA(hwnd,
+            win32con_WM_COPYDATA, ctypes.sizeof(cds), ctypes.byref(cds))
 
         if response > 0:
+            pymap.seek(0)
             datalen = pymap.read(4)
             retlen = struct.unpack('>I', datalen)[0]
             return datalen + pymap.read(retlen)
         return None
-    finally:
-        pymap.close()
-        f.close()
-        # Remove the file, it was temporary only
-        os.unlink(filename)
 
 
-class PageantConnection (object):
+class PageantConnection(object):
     """
     Mock "connection" to an agent which roughly approximates the behavior of
     a unix local-domain socket (as used by Agent).  Requests are sent to the