added log function (no longer use fprintf).

17 files changed, 145 insertions, 104 deletions

diff --git a/lib/auth_srp_sb64.c b/lib/auth_srp_sb64.c
index 4d6ff0e309..c43f818ede 100644
--- a/lib/auth_srp_sb64.c
+++ b/lib/auth_srp_sb64.c
@@ -294,7 +294,7 @@ int main()
 
 
 	if (siz < 0) {
-		fprintf(stderr, "ERROR %d\n", siz);
+		_gnutls_log( "ERROR %d\n", siz);
 		exit(1);
 	}
 
diff --git a/lib/cert_b64.c b/lib/cert_b64.c
index d953c4dd2c..e2dce38f4d 100644
--- a/lib/cert_b64.c
+++ b/lib/cert_b64.c
@@ -393,7 +393,7 @@ int main()
 
 
 	if (siz < 0) {
-		fprintf(stderr, "ERROR %d\n", siz);
+		_gnutls_log( "ERROR %d\n", siz);
 		exit(1);
 	}
 	fwrite(b64, siz, 1, stdout);
diff --git a/lib/debug.c b/lib/debug.c
index b970af0b7e..3a20501955 100644
--- a/lib/debug.c
+++ b/lib/debug.c
@@ -32,7 +32,7 @@ void _gnutls_dump_mpi(char* prefix, MPI a)
 	
 	if (gcry_mpi_print(GCRYMPI_FMT_HEX, buf, &n, a))
 		strcpy(buf, "[can't print value]");
-	fprintf(stderr, "MPI: length: %d\n\t%s%s\n", (n-1)/2, prefix, buf);
+	_gnutls_log( "MPI: length: %d\n\t%s%s\n", (n-1)/2, prefix, buf);
 }
 
 
@@ -57,16 +57,16 @@ char *_gnutls_bin2hex(const unsigned char *old, const size_t oldlen)
 void _gnutls_print_state(GNUTLS_STATE state)
 {
 
-	fprintf(stderr, "GNUTLS State:\n");
-	fprintf(stderr, "Connection End: %d\n",
+	_gnutls_log( "GNUTLS State:\n");
+	_gnutls_log( "Connection End: %d\n",
 		state->security_parameters.entity);
-	fprintf(stderr, "Cipher Algorithm: %d\n",
+	_gnutls_log( "Cipher Algorithm: %d\n",
 		state->security_parameters.read_bulk_cipher_algorithm);
-	fprintf(stderr, "MAC algorithm: %d\n",
+	_gnutls_log( "MAC algorithm: %d\n",
 		state->security_parameters.read_mac_algorithm);
-	fprintf(stderr, "Compression Algorithm: %d\n",
+	_gnutls_log( "Compression Algorithm: %d\n",
 		state->security_parameters.read_compression_algorithm);
-	fprintf(stderr, "\n");
+	_gnutls_log( "\n");
 
 }
 
diff --git a/lib/gnutls.h.in b/lib/gnutls.h.in
index 761cb8f34f..6b6c6d2c89 100644
--- a/lib/gnutls.h.in
+++ b/lib/gnutls.h.in
@@ -236,9 +236,7 @@ void gnutls_global_deinit();
 
 typedef ssize_t (*RECV_FUNC)(SOCKET, void*, size_t,int);
 typedef ssize_t (*SEND_FUNC)(SOCKET, const void*, size_t,int);
-
-RECV_FUNC _gnutls_recv_func;
-SEND_FUNC _gnutls_send_func;
+typedef void (*LOG_FUNC)( const char*);
 
 void gnutls_global_set_send_func( SEND_FUNC send_func);
 void gnutls_global_set_recv_func( RECV_FUNC recv_func);
diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c
index f15504a3e3..9dac868e05 100644
--- a/lib/gnutls_algorithms.c
+++ b/lib/gnutls_algorithms.c
@@ -959,7 +959,7 @@ _gnutls_qsort(GNUTLS_STATE state, void *_base, size_t nmemb, size_t size,
 #ifdef DEBUG
 	if (size > MAX_ELEM_SIZE) {
 		gnutls_assert();
-		fprintf(stderr, "QSORT BUG\n");
+		_gnutls_log( "QSORT BUG\n");
 		exit(1);
 	}
 #endif
@@ -1062,9 +1062,9 @@ _gnutls_supported_ciphersuites_sorted(GNUTLS_STATE state,
 	}
 
 #ifdef SORT_DEBUG
-	fprintf(stderr, "Unsorted: \n");
+	_gnutls_log( "Unsorted: \n");
 	for (i = 0; i < count; i++)
-		fprintf(stderr, "\t%d: %s\n", i,
+		_gnutls_log( "\t%d: %s\n", i,
 			_gnutls_cipher_suite_get_name((tmp_ciphers)[i]));
 #endif
 
@@ -1095,11 +1095,11 @@ _gnutls_supported_ciphersuites_sorted(GNUTLS_STATE state,
 	}
 
 #ifdef SORT_DEBUG
-	fprintf(stderr, "Sorted: \n");
+	_gnutls_log( "Sorted: \n");
 	for (i = 0; i < j; i++)
-		fprintf(stderr, "\t%d: %s\n", i,
+		_gnutls_log( "\t%d: %s\n", i,
 			_gnutls_cipher_suite_get_name((*ciphers)[i]));
-	fprintf(stderr, "SORT BUG\n");
+	_gnutls_log( "SORT BUG\n");
 	exit(0);
 #endif
 
diff --git a/lib/gnutls_buffers.c b/lib/gnutls_buffers.c
index e7700eb72b..b2a77944da 100644
--- a/lib/gnutls_buffers.c
+++ b/lib/gnutls_buffers.c
@@ -38,7 +38,7 @@ int gnutls_insertDataBuffer(ContentType type, GNUTLS_STATE state, char *data, in
 
 		state->gnutls_internals.buffer.size += length;
 #ifdef BUFFERS_DEBUG
-	fprintf(stderr, "BUFFER: Inserted %d bytes of Data(%d)\n", length, type);
+	_gnutls_log( "BUFFER: Inserted %d bytes of Data(%d)\n", length, type);
 #endif
 		state->gnutls_internals.buffer.data =
 		    gnutls_realloc(state->gnutls_internals.buffer.data,
@@ -50,7 +50,7 @@ int gnutls_insertDataBuffer(ContentType type, GNUTLS_STATE state, char *data, in
 
 		state->gnutls_internals.buffer_handshake.size += length;
 #ifdef BUFFERS_DEBUG
-	fprintf(stderr, "BUFFER: Inserted %d bytes of Data(%d)\n", length, type);
+	_gnutls_log( "BUFFER: Inserted %d bytes of Data(%d)\n", length, type);
 #endif
 		state->gnutls_internals.buffer_handshake.data =
 		    gnutls_realloc(state->gnutls_internals.buffer_handshake.data,
@@ -94,7 +94,7 @@ int gnutls_getDataFromBuffer(ContentType type, GNUTLS_STATE state, char *data, i
 			length = state->gnutls_internals.buffer.size;
 		}
 #ifdef BUFFERS_DEBUG
-	fprintf(stderr, "BUFFER: Read %d bytes of Data(%d)\n", length, type);
+	_gnutls_log( "BUFFER: Read %d bytes of Data(%d)\n", length, type);
 #endif
 		state->gnutls_internals.buffer.size -= length;
 		memcpy(data, state->gnutls_internals.buffer.data, length);
@@ -112,7 +112,7 @@ int gnutls_getDataFromBuffer(ContentType type, GNUTLS_STATE state, char *data, i
 			length = state->gnutls_internals.buffer_handshake.size;
 		}
 #ifdef BUFFERS_DEBUG
-	fprintf(stderr, "BUFFER: Read %d bytes of Data(%d)\n", length, type);
+	_gnutls_log( "BUFFER: Read %d bytes of Data(%d)\n", length, type);
 #endif
 		state->gnutls_internals.buffer_handshake.size -= length;
 		memcpy(data, state->gnutls_internals.buffer_handshake.data, length);
@@ -158,15 +158,15 @@ ssize_t _gnutls_Read(int fd, void *iptr, size_t sizeOfPtr, int flag)
 	}
 
 #ifdef READ_DEBUG
-	fprintf(stderr, "READ: read %d bytes from %d\n", (sizeOfPtr-left), fd);
+	_gnutls_log( "READ: read %d bytes from %d\n", (sizeOfPtr-left), fd);
 	for (x=0;x<((sizeOfPtr-left)/16)+1;x++) {
-		fprintf(stderr, "%.4x - ",x);
+		_gnutls_log( "%.4x - ",x);
 		for (j=0;j<16;j++) {
 			if (sum<(sizeOfPtr-left)) {
-				fprintf(stderr, "%.2x ", ((unsigned char*)ptr)[sum++]);
+				_gnutls_log( "%.2x ", ((unsigned char*)ptr)[sum++]);
 			}
 		}
-		fprintf(stderr, "\n");
+		_gnutls_log( "\n");
 	
 	}
 #endif
@@ -189,15 +189,15 @@ ssize_t _gnutls_Write(int fd, const void *iptr, size_t n, int flags)
 	const char *ptr = iptr;
 
 #ifdef WRITE_DEBUG
-	fprintf(stderr, "WRITE: wrote %d bytes to %d\n", n, fd);
+	_gnutls_log( "WRITE: wrote %d bytes to %d\n", n, fd);
 	for (x=0;x<(n/16)+1;x++) {
-		fprintf(stderr, "%.4x - ",x);
+		_gnutls_log( "%.4x - ",x);
 		for (j=0;j<16;j++) {
 			if (sum<n) {
-				fprintf(stderr, "%.2x ", ((unsigned char*)ptr)[sum++]);
+				_gnutls_log( "%.2x ", ((unsigned char*)ptr)[sum++]);
 			}
 		}
-		fprintf(stderr, "\n");
+		_gnutls_log( "\n");
 	
 	}
 #endif
@@ -264,7 +264,7 @@ int gnutls_insertHashDataBuffer( GNUTLS_STATE state, char *data, int length)
 
 	state->gnutls_internals.hash_buffer.size += length;
 #ifdef BUFFERS_DEBUG
-	fprintf(stderr, "HASH_BUFFER: Inserted %d bytes of Data\n", length);
+	_gnutls_log( "HASH_BUFFER: Inserted %d bytes of Data\n", length);
 #endif
 	state->gnutls_internals.hash_buffer.data =
 		    gnutls_realloc(state->gnutls_internals.hash_buffer.data,
@@ -286,7 +286,7 @@ int gnutls_getHashDataFromBuffer( GNUTLS_STATE state, char *data, int length)
 		length = state->gnutls_internals.hash_buffer.size;
 	}
 #ifdef BUFFERS_DEBUG
-	fprintf(stderr, "HASH BUFFER: Got %d bytes of Data\n", length);
+	_gnutls_log( "HASH BUFFER: Got %d bytes of Data\n", length);
 #endif
 	state->gnutls_internals.hash_buffer.size -= length;
 	memcpy(data, state->gnutls_internals.hash_buffer.data, length);
@@ -310,7 +310,7 @@ int gnutls_readHashDataFromBuffer( GNUTLS_STATE state, char *data, int length)
 		length = state->gnutls_internals.hash_buffer.size;
 	}
 #ifdef BUFFERS_DEBUG
-	fprintf(stderr, "HASH BUFFER: Read %d bytes of Data\n", length);
+	_gnutls_log( "HASH BUFFER: Read %d bytes of Data\n", length);
 #endif
 	memcpy(data, state->gnutls_internals.hash_buffer.data, length);
 	return length;	
@@ -322,7 +322,7 @@ int gnutls_clearHashDataBuffer( GNUTLS_STATE state)
 {
 
 #ifdef BUFFERS_DEBUG
-	fprintf(stderr, "HASH BUFFER: Cleared Data from buffer\n");
+	_gnutls_log( "HASH BUFFER: Cleared Data from buffer\n");
 #endif
 	state->gnutls_internals.hash_buffer.size = 0;
 	if (state->gnutls_internals.hash_buffer.data!=NULL)
diff --git a/lib/gnutls_cert.c b/lib/gnutls_cert.c
index f300e37c9c..add48fdaf3 100644
--- a/lib/gnutls_cert.c
+++ b/lib/gnutls_cert.c
@@ -673,7 +673,7 @@ int _gnutls_cert2gnutlsCert(gnutls_cert * gCert, gnutls_datum derCert)
 	if (result != ASN_OK) {
 		/* couldn't decode DER */
 #ifdef DEBUG
-		fprintf(stderr, "Decoding error %d\n", result);
+		_gnutls_log( "Decoding error %d\n", result);
 #endif		
 		gnutls_assert();
 		return GNUTLS_E_ASN1_PARSING_ERROR;
@@ -720,7 +720,7 @@ int _gnutls_cert2gnutlsCert(gnutls_cert * gCert, gnutls_datum derCert)
 		 */
 		gnutls_assert();
 #ifdef DEBUG
-fprintf(stderr, "ALGORITHM: %s\n", str);
+_gnutls_log( "ALGORITHM: %s\n", str);
 return GNUTLS_E_UNIMPLEMENTED_FEATURE;
 #endif
 		gCert->subject_pk_algorithm = GNUTLS_PK_UNKNOWN;
diff --git a/lib/gnutls_constate.c b/lib/gnutls_constate.c
index 7550a59f61..a510486c37 100644
--- a/lib/gnutls_constate.c
+++ b/lib/gnutls_constate.c
@@ -66,7 +66,7 @@ int _gnutls_set_keys(GNUTLS_STATE state, int hash_size, int IV_size, int key_siz
 	if (key_block==NULL) return GNUTLS_E_MEMORY_ERROR;
 
 #ifdef HARD_DEBUG
-	fprintf(stderr, "KEY BLOCK[%d]: %s\n",block_size, _gnutls_bin2hex(key_block, block_size));
+	_gnutls_log( "KEY BLOCK[%d]: %s\n",block_size, _gnutls_bin2hex(key_block, block_size));
 #endif
 
 	pos = 0;
@@ -237,7 +237,7 @@ int rc;
 	_gnutls_set_read_keys(state);
 	 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Cipher Suite: %s\n",
+	_gnutls_log( "Cipher Suite: %s\n",
 		_gnutls_cipher_suite_get_name(state->
 					      security_parameters.current_cipher_suite));
 #endif
@@ -267,7 +267,7 @@ int rc;
 						read_mac_algorithm);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Handshake: Initializing internal [read] cipher states\n");
+	_gnutls_log( "Handshake: Initializing internal [read] cipher states\n");
 #endif
 
 	switch (state->security_parameters.entity) {
@@ -382,7 +382,7 @@ int rc;
 	_gnutls_set_write_keys(state);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Cipher Suite: %s\n",
+	_gnutls_log( "Cipher Suite: %s\n",
 		_gnutls_cipher_suite_get_name(state->
 					      security_parameters.current_cipher_suite));
 #endif
@@ -413,7 +413,7 @@ int rc;
 					write_mac_algorithm);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Handshake: Initializing internal [write] cipher states\n");
+	_gnutls_log( "Handshake: Initializing internal [write] cipher states\n");
 #endif
 
 	switch (state->security_parameters.entity) {
diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index 65b3ea8480..5f4b5f953d 100644
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -20,6 +20,8 @@
 
 #include "gnutls_errors.h"
 
+extern void (*_gnutls_log_func)( const char*);
+
 
 #define GNUTLS_ERROR_ENTRY(name, fatal) \
 	{ #name, name, fatal }
@@ -124,7 +126,7 @@ void gnutls_perror(int error)
 	GNUTLS_ERROR_ALG_LOOP(ret =
 			      gnutls_strdup(p->name + sizeof("GNUTLS_E_") - 1));
 
-	fprintf(stderr, "GNUTLS ERROR: %s\n", ret);
+	_gnutls_log( "GNUTLS ERROR: %s\n", ret);
 	
 	free( ret);
 }
@@ -148,3 +150,20 @@ const char* gnutls_strerror(int error)
 
 	return ret;
 }
+
+/* this function will output a message using the
+ * caller provided function 
+ */
+void _gnutls_log( const char *fmt, ...) {
+ va_list args;
+ char str[MAX_LOG_SIZE];
+ void (*log_func)() = _gnutls_log_func;
+ 
+ va_start(args,fmt);
+ vsprintf( str,fmt,args);
+ va_end(args);   
+  
+ log_func( str);
+ 
+ return;
+}
diff --git a/lib/gnutls_errors.h b/lib/gnutls_errors.h
index d60e4dfb35..d46f232e04 100644
--- a/lib/gnutls_errors.h
+++ b/lib/gnutls_errors.h
@@ -38,3 +38,4 @@
 const char* gnutls_strerror(int error);
 void gnutls_perror(int error);
 int gnutls_is_fatal_error( int error);
+void _gnutls_log( const char *fmt, ...);
diff --git a/lib/gnutls_global.c b/lib/gnutls_global.c
index 1f83b8f459..82f3ece254 100644
--- a/lib/gnutls_global.c
+++ b/lib/gnutls_global.c
@@ -33,9 +33,11 @@ static void* old_sig_handler;
 
 typedef ssize_t (*RECV_FUNC)(SOCKET, void*, size_t,int);
 typedef ssize_t (*SEND_FUNC)(SOCKET, const void*, size_t,int);
+typedef void (*LOG_FUNC)( const char*);
 
 RECV_FUNC _gnutls_recv_func;
 SEND_FUNC _gnutls_send_func;
+LOG_FUNC _gnutls_log_func;
 
 static node_asn *PKIX1_ASN;
 static node_asn *PKCS1_ASN;
@@ -79,10 +81,29 @@ void gnutls_global_set_send_func( SEND_FUNC send_func) {
 	_gnutls_send_func = send_func;
 }
 
+/**
+  * gnutls_global_set_log_func - This function sets the logging function
+  * @send_func: it's a send(2) like function
+  *
+  * This is the function were you set the logging function gnutls
+  * is going to use. Normaly you may not use this function since
+  * it is only used for debug reason.
+  **/
+void gnutls_global_set_log_func( LOG_FUNC log_func) {
+	_gnutls_log_func = log_func;
+}
+
 int gnutls_is_secure_memory(const void* mem) {
 	return 0;
 }
 
+/* default logging function */
+static void dlog( const char* str) {
+#ifdef DEBUG
+	fprintf( stderr, str);
+#endif
+}
+
 /**
   * gnutls_global_init - This function initializes the global state to defaults.
   *
@@ -108,6 +129,7 @@ int gnutls_global_init()
 	 */
 	_gnutls_recv_func = recv;
 	_gnutls_send_func = send;
+	_gnutls_log_func = dlog;
 
 	/* initialize parser 
 	 * This should not deal with files in the final
diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 476e419e0d..d40457955c 100644
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -40,7 +40,7 @@
 #include "gnutls_constate.h"
 
 #ifdef HANDSHAKE_DEBUG
-#define ERR(x, y) fprintf(stderr, "GNUTLS Error: %s (%d)\n", x,y)
+#define ERR(x, y) _gnutls_log( "GNUTLS Error: %s (%d)\n", x,y)
 #else
 #define ERR(x, y)
 #endif
@@ -252,7 +252,7 @@ int _gnutls_read_client_hello(GNUTLS_STATE state, opaque * data,
 	DECR_LEN(len, 2);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Client's version: %d.%d\n", data[pos],
+	_gnutls_log( "Client's version: %d.%d\n", data[pos],
 		data[pos + 1]);
 #endif
 
@@ -355,7 +355,7 @@ int _gnutls_read_client_hello(GNUTLS_STATE state, opaque * data,
 				    current_cipher_suite));
 	if (state->gnutls_internals.auth_struct == NULL) {
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr,
+		_gnutls_log(
 			"Cannot find the appropriate handler for the KX algorithm\n");
 #endif
 		gnutls_assert();
@@ -371,7 +371,7 @@ int _gnutls_read_client_hello(GNUTLS_STATE state, opaque * data,
 					      compression_method,
 					      &data[pos], z);
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Selected Compression Method: %s\n",
+	_gnutls_log( "Selected Compression Method: %s\n",
 		gnutls_compression_get_name(state->gnutls_internals.
 					    compression_method));
 #endif
@@ -501,15 +501,15 @@ static int _gnutls_server_SelectSuite(GNUTLS_STATE state, opaque ret[2],
 	x = _gnutls_remove_unwanted_ciphersuites(state, &ciphers, x);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Requested cipher suites: \n");
+	_gnutls_log( "Requested cipher suites: \n");
 	for (j = 0; j < datalen; j += 2)
-		fprintf(stderr, "\t%s\n",
+		_gnutls_log( "\t%s\n",
 			_gnutls_cipher_suite_get_name(*
 						      ((GNUTLS_CipherSuite
 							*) & data[j])));
-	fprintf(stderr, "Supported cipher suites: \n");
+	_gnutls_log( "Supported cipher suites: \n");
 	for (j = 0; j < x; j++)
-		fprintf(stderr, "\t%s\n",
+		_gnutls_log( "\t%s\n",
 			_gnutls_cipher_suite_get_name(ciphers[j]));
 #endif
 	memset(ret, '\0', 2);
@@ -519,8 +519,8 @@ static int _gnutls_server_SelectSuite(GNUTLS_STATE state, opaque ret[2],
 			if (memcmp(ciphers[i].CipherSuite, &data[j], 2) ==
 			    0) {
 #ifdef HANDSHAKE_DEBUG
-				fprintf(stderr, "Selected cipher suite: ");
-				fprintf(stderr, "%s\n",
+				_gnutls_log( "Selected cipher suite: ");
+				_gnutls_log( "%s\n",
 					_gnutls_cipher_suite_get_name(*
 								      ((GNUTLS_CipherSuite *) & data[j])));
 #endif
@@ -592,7 +592,7 @@ int _gnutls_send_handshake(SOCKET cd, GNUTLS_STATE state, void *i_data,
 		memcpy(&data[pos], i_data, i_datasize - 4);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Handshake: %s was send [%ld bytes]\n",
+	_gnutls_log( "Handshake: %s was send [%ld bytes]\n",
 		_gnutls_handshake2str(type), i_datasize);
 #endif
 
@@ -671,7 +671,7 @@ int _gnutls_recv_handshake(SOCKET cd, GNUTLS_STATE state, uint8 ** data,
 		length32 = READuint24(&dataptr[1]);
 
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr, "Handshake: %s was received [%ld bytes]\n",
+		_gnutls_log( "Handshake: %s was received [%ld bytes]\n",
 			_gnutls_handshake2str(dataptr[0]),
 			length32 + HANDSHAKE_HEADERS_SIZE);
 #endif
@@ -684,7 +684,7 @@ int _gnutls_recv_handshake(SOCKET cd, GNUTLS_STATE state, uint8 ** data,
 
 		recv_type = dataptr[0];
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr,
+		_gnutls_log(
 			"Handshake: %s(v2) was received [%ld bytes]\n",
 			_gnutls_handshake2str(recv_type),
 			length32 + handshake_headers);
@@ -757,7 +757,7 @@ int _gnutls_recv_handshake(SOCKET cd, GNUTLS_STATE state, uint8 ** data,
 		break;
 	case GNUTLS_CERTIFICATE_REQUEST:
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr, "Requested Client Certificate!\n");
+		_gnutls_log( "Requested Client Certificate!\n");
 #endif
 		/* FIXME: just ignore that message for the time being 
 		 * we have to parse it and the store the needed information
@@ -825,7 +825,7 @@ static int _gnutls_read_server_hello(GNUTLS_STATE state, char *data,
 		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 	}
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Server's version: %d.%d\n", data[pos],
+	_gnutls_log( "Server's version: %d.%d\n", data[pos],
 		data[pos + 1]);
 #endif
 	DECR_LEN(len, 2);
@@ -853,8 +853,8 @@ static int _gnutls_read_server_hello(GNUTLS_STATE state, char *data,
 	DECR_LEN(len, session_id_len);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "SessionID length: %d\n", session_id_len);
-	fprintf(stderr, "SessionID: %s\n",
+	_gnutls_log( "SessionID length: %d\n", session_id_len);
+	_gnutls_log( "SessionID: %s\n",
 		_gnutls_bin2hex(&data[pos], session_id_len));
 #endif
 	if ((state->gnutls_internals.resumed_security_parameters.
@@ -907,8 +907,8 @@ static int _gnutls_read_server_hello(GNUTLS_STATE state, char *data,
 	       cipher_suite.CipherSuite, 2);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Selected cipher suite: ");
-	fprintf(stderr, "%s\n",
+	_gnutls_log( "Selected cipher suite: ");
+	_gnutls_log( "%s\n",
 		_gnutls_cipher_suite_get_name(state->
 					      security_parameters.
 					      current_cipher_suite));
@@ -936,7 +936,7 @@ static int _gnutls_read_server_hello(GNUTLS_STATE state, char *data,
 				   (cipher_suite));
 	if (state->gnutls_internals.auth_struct == NULL) {
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr,
+		_gnutls_log(
 			"Cannot find the appropriate handler for the KX algorithm\n");
 #endif
 		gnutls_assert();
@@ -1110,7 +1110,7 @@ static int _gnutls_send_server_hello(SOCKET cd, GNUTLS_STATE state)
 	pos += session_id_len;
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Handshake: SessionID: %s\n",
+	_gnutls_log( "Handshake: SessionID: %s\n",
 		_gnutls_bin2hex(SessionID, session_id_len));
 #endif
 
@@ -1264,7 +1264,7 @@ int gnutls_handshake_begin(SOCKET cd, GNUTLS_STATE state)
 #ifdef HANDSHAKE_DEBUG
 		if (state->gnutls_internals.resumed_security_parameters.
 		    session_id_size > 0)
-			fprintf(stderr, "Ask to resume: %s\n",
+			_gnutls_log( "Ask to resume: %s\n",
 				_gnutls_bin2hex(state->gnutls_internals.
 						resumed_security_parameters.
 						session_id,
@@ -1650,7 +1650,7 @@ int _gnutls_generate_session_id(char *session_id, uint8 * len)
 	*len = TLS_RANDOM_SIZE;
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Generated SessionID: %s\n",
+	_gnutls_log( "Generated SessionID: %s\n",
 		_gnutls_bin2hex(session_id, TLS_RANDOM_SIZE));
 #endif
 	return 0;
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 19a8bf04e9..ce8004907c 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -48,6 +48,7 @@
 #define MAX_HASH_SIZE 20
 
 #define MAX_X509_CERT_SIZE 10*1024
+#define MAX_LOG_SIZE 1024 /* maximum number of log message */
 
 #define MAX_DNSNAME_SIZE 256
 
diff --git a/lib/gnutls_kx.c b/lib/gnutls_kx.c
index a073cbf1e2..30b8f666ac 100644
--- a/lib/gnutls_kx.c
+++ b/lib/gnutls_kx.c
@@ -53,9 +53,9 @@ char random[2*TLS_RANDOM_SIZE];
 	premaster = state->gnutls_key->key.data;
 
 #ifdef HARD_DEBUG
-	fprintf(stderr, "PREMASTER SECRET[%d]: %s\n", premaster_size, _gnutls_bin2hex(premaster, premaster_size));
-	fprintf(stderr, "CLIENT RANDOM[%d]: %s\n", 32, _gnutls_bin2hex(state->security_parameters.client_random,32));
-	fprintf(stderr, "SERVER RANDOM[%d]: %s\n", 32, _gnutls_bin2hex(state->security_parameters.server_random,32));
+	_gnutls_log( "PREMASTER SECRET[%d]: %s\n", premaster_size, _gnutls_bin2hex(premaster, premaster_size));
+	_gnutls_log( "CLIENT RANDOM[%d]: %s\n", 32, _gnutls_bin2hex(state->security_parameters.client_random,32));
+	_gnutls_log( "SERVER RANDOM[%d]: %s\n", 32, _gnutls_bin2hex(state->security_parameters.server_random,32));
 #endif
 
 	if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
@@ -76,7 +76,7 @@ char random[2*TLS_RANDOM_SIZE];
 	if (master==NULL) return GNUTLS_E_MEMORY_ERROR;
 	
 #ifdef HARD_DEBUG
-	fprintf(stderr, "MASTER SECRET: %s\n", _gnutls_bin2hex(master, TLS_MASTER_SIZE));
+	_gnutls_log( "MASTER SECRET: %s\n", _gnutls_bin2hex(master, TLS_MASTER_SIZE));
 #endif
 	memcpy(state->security_parameters.master_secret, master, TLS_MASTER_SIZE);
 	secure_free(master);
@@ -98,7 +98,7 @@ int _gnutls_send_server_kx_message(SOCKET cd, GNUTLS_STATE state)
 		return 0;
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Sending server KX message\n");
+	_gnutls_log( "Sending server KX message\n");
 #endif
 
 
@@ -130,7 +130,7 @@ int _gnutls_send_server_kx_message2(SOCKET cd, GNUTLS_STATE state)
 		data_size = state->gnutls_internals.auth_struct->gnutls_generate_server_kx2( state->gnutls_key, &data);
 
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr, "Sending server KX message2\n");
+		_gnutls_log( "Sending server KX message2\n");
 #endif
 
 		if (data_size<0) {
@@ -162,7 +162,7 @@ int _gnutls_send_client_kx_message(SOCKET cd, GNUTLS_STATE state)
 		return 0;
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Sending client KX message\n");
+	_gnutls_log( "Sending client KX message\n");
 #endif
 
 	data_size = state->gnutls_internals.auth_struct->gnutls_generate_client_kx( state->gnutls_key, &data);
@@ -194,7 +194,7 @@ int _gnutls_send_client_kx_message0(SOCKET cd, GNUTLS_STATE state)
 		return 0;
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Sending client KX message0\n");
+	_gnutls_log( "Sending client KX message0\n");
 #endif
 
 	data_size = state->gnutls_internals.auth_struct->gnutls_generate_client_kx0( state->gnutls_key, &data);
@@ -235,7 +235,7 @@ int _gnutls_send_client_certificate_verify(SOCKET cd, GNUTLS_STATE state)
 	}
 	
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Sending client certificate verify message\n");
+	_gnutls_log( "Sending client certificate verify message\n");
 #endif
 	data_size = state->gnutls_internals.auth_struct->gnutls_generate_client_cert_vrfy( state->gnutls_key, &data);
 	if (data_size < 0) 
@@ -259,7 +259,7 @@ int _gnutls_recv_server_kx_message(SOCKET cd, GNUTLS_STATE state)
 	if (state->gnutls_internals.auth_struct->gnutls_process_server_kx!=NULL) {
 
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr, "Receiving Server KX message\n");
+		_gnutls_log( "Receiving Server KX message\n");
 #endif
 
 		ret =
@@ -289,7 +289,7 @@ int _gnutls_recv_server_kx_message2(SOCKET cd, GNUTLS_STATE state)
 	if (state->gnutls_internals.auth_struct->gnutls_process_server_kx2 != NULL) {
 
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr, "Receiving Server KX message2\n");
+		_gnutls_log( "Receiving Server KX message2\n");
 #endif
 
 		ret =
@@ -320,7 +320,7 @@ int _gnutls_recv_client_kx_message(SOCKET cd, GNUTLS_STATE state)
 	if (state->gnutls_internals.auth_struct->gnutls_process_client_kx != NULL) {
 
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr, "Receiving client KX message\n");
+		_gnutls_log( "Receiving client KX message\n");
 #endif
 
 		ret =
@@ -351,7 +351,7 @@ int _gnutls_recv_client_kx_message0(SOCKET cd, GNUTLS_STATE state)
 	if (state->gnutls_internals.auth_struct->gnutls_process_client_kx0 != NULL) {
 
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr, "Receiving client KX message0\n");
+		_gnutls_log( "Receiving client KX message0\n");
 #endif
 
 		ret =
@@ -383,7 +383,7 @@ int _gnutls_send_certificate(SOCKET cd, GNUTLS_STATE state)
 		return 0;
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Sending certificate message\n");
+	_gnutls_log( "Sending certificate message\n");
 #endif
 
 
@@ -440,7 +440,7 @@ int _gnutls_send_client_certificate(SOCKET cd, GNUTLS_STATE state)
 		return 0;
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Sending Client Certificate\n");
+	_gnutls_log( "Sending Client Certificate\n");
 #endif
 
 	return _gnutls_send_certificate(cd, state);
diff --git a/lib/gnutls_record.c b/lib/gnutls_record.c
index ce203399ca..2a5321c317 100644
--- a/lib/gnutls_record.c
+++ b/lib/gnutls_record.c
@@ -342,7 +342,7 @@ int _gnutls_send_alert(SOCKET cd, GNUTLS_STATE state, AlertLevel level, AlertDes
 	memcpy(&data[1], &desc, 1);
 
 #ifdef RECORD_DEBUG
-	fprintf(stderr, "Record: Sending Alert[%d|%d] - %s\n", data[0], data[1], _gnutls_alert2str((int)data[1]));
+	_gnutls_log( "Record: Sending Alert[%d|%d] - %s\n", data[0], data[1], _gnutls_alert2str((int)data[1]));
 #endif
 
 	return gnutls_send_int(cd, state, GNUTLS_ALERT, -1, data, 2, 0);
@@ -424,7 +424,7 @@ ssize_t gnutls_send_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 
 	
 #ifdef RECORD_DEBUG
-	fprintf(stderr, "Record: Sending Packet[%d] %s(%d) with length: %d\n",
+	_gnutls_log( "Record: Sending Packet[%d] %s(%d) with length: %d\n",
 		(int) uint64touint32(&state->connection_state.write_sequence_number), _gnutls_packet2str(type), type, sizeofdata);
 #endif
 
@@ -451,7 +451,7 @@ ssize_t gnutls_send_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 #ifdef RECORD_DEBUG
-		fprintf(stderr, "Record: Sended Packet[%d] %s(%d) with length: %d\n",
+		_gnutls_log( "Record: Sended Packet[%d] %s(%d) with length: %d\n",
 		(int) uint64touint32(&state->connection_state.write_sequence_number), _gnutls_packet2str(type), type, cipher_size);
 #endif
 
@@ -507,7 +507,7 @@ ssize_t _gnutls_send_change_cipher_spec(SOCKET cd, GNUTLS_STATE state)
 	opaque data[1] = { GNUTLS_TYPE_CHANGE_CIPHER_SPEC };
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Record: Sending ChangeCipherSpec\n");
+	_gnutls_log( "Record: Sending ChangeCipherSpec\n");
 #endif
 
 	return gnutls_send_int( cd, state, GNUTLS_CHANGE_CIPHER_SPEC, -1, data, 1, 0);
@@ -593,7 +593,7 @@ ssize_t gnutls_recv_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 					       */
 		state->gnutls_internals.v2_hello = length;
 #ifdef RECORD_DEBUG
-		fprintf(stderr, "Record: V2 packet received. Length: %d\n", length);
+		_gnutls_log( "Record: V2 packet received. Length: %d\n", length);
 #endif
 
 	} else {
@@ -611,7 +611,7 @@ ssize_t gnutls_recv_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 	if ( (htype!=GNUTLS_CLIENT_HELLO && htype!=GNUTLS_SERVER_HELLO) && gnutls_get_current_version(state) != version) {
 		gnutls_assert();
 # ifdef RECORD_DEBUG
-		fprintf(stderr, "Record: INVALID VERSION PACKET: (%d/%d) %d.%d\n", headers[0], htype, headers[1], headers[2]);
+		_gnutls_log( "Record: INVALID VERSION PACKET: (%d/%d) %d.%d\n", headers[0], htype, headers[1], headers[2]);
 # endif
 		if (type!=GNUTLS_ALERT) {
 			/* some browsers return garbage, when
@@ -626,15 +626,15 @@ ssize_t gnutls_recv_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 #endif
 
 #ifdef RECORD_DEBUG
-	fprintf(stderr, "Record: Expected Packet[%d] %s(%d) with length: %d\n",
+	_gnutls_log( "Record: Expected Packet[%d] %s(%d) with length: %d\n",
 		(int) uint64touint32(&state->connection_state.read_sequence_number), _gnutls_packet2str(type), type, sizeofdata);
-	fprintf(stderr, "Record: Received Packet[%d] %s(%d) with length: %d\n",
+	_gnutls_log( "Record: Received Packet[%d] %s(%d) with length: %d\n",
 		(int) uint64touint32(&state->connection_state.read_sequence_number), _gnutls_packet2str(recv_type), recv_type, length);
 #endif
 
 	if (length > MAX_RECV_SIZE) {
 #ifdef RECORD_DEBUG
-		fprintf(stderr, "Record: FATAL ERROR: Received packet with length: %d\n", length);
+		_gnutls_log( "Record: FATAL ERROR: Received packet with length: %d\n", length);
 #endif
 		_gnutls_send_alert(cd, state, GNUTLS_FATAL, GNUTLS_RECORD_OVERFLOW);
 		state->gnutls_internals.valid_connection = VALID_FALSE;
@@ -688,7 +688,7 @@ ssize_t gnutls_recv_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 	 */
 	if (ret != length) {
 #ifdef RECORD_DEBUG
-		fprintf(stderr, "Record: Received packet with length: %d\nExpected %d\n", ret, length);
+		_gnutls_log( "Record: Received packet with length: %d\nExpected %d\n", ret, length);
 #endif
 		gnutls_free(ciphertext);
 		state->gnutls_internals.valid_connection = VALID_FALSE;
@@ -724,7 +724,7 @@ ssize_t gnutls_recv_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 	 */
 	if (type == GNUTLS_CHANGE_CIPHER_SPEC && recv_type == GNUTLS_CHANGE_CIPHER_SPEC) {
 #ifdef RECORD_DEBUG
-		fprintf(stderr, "Record: ChangeCipherSpec Packet was received\n");
+		_gnutls_log( "Record: ChangeCipherSpec Packet was received\n");
 #endif
 
 		gnutls_free(ciphertext);
@@ -741,7 +741,7 @@ ssize_t gnutls_recv_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 	}
 
 #ifdef RECORD_DEBUG
-	fprintf(stderr, "Record: Decrypted Packet[%d] %s(%d) with length: %d\n",
+	_gnutls_log( "Record: Decrypted Packet[%d] %s(%d) with length: %d\n",
 		(int) uint64touint32(&state->connection_state.read_sequence_number), _gnutls_packet2str(recv_type), recv_type, tmplen);
 #endif
 
@@ -761,7 +761,7 @@ ssize_t gnutls_recv_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 		switch (recv_type) {
 		case GNUTLS_ALERT:
 #ifdef RECORD_DEBUG
-			fprintf(stderr, "Record: Alert[%d|%d] - %s - was received\n", tmpdata[0], tmpdata[1], _gnutls_alert2str((int)tmpdata[1]));
+			_gnutls_log( "Record: Alert[%d|%d] - %s - was received\n", tmpdata[0], tmpdata[1], _gnutls_alert2str((int)tmpdata[1]));
 #endif
 			state->gnutls_internals.last_alert = tmpdata[1];
 
@@ -830,7 +830,7 @@ ssize_t gnutls_recv_int(SOCKET cd, GNUTLS_STATE state, ContentType type, Handsha
 			break;
 		default:
 #ifdef RECORD_DEBUG
-			fprintf(stderr, "Record: Received Unknown packet %d expecting %d\n", recv_type, type);
+			_gnutls_log( "Record: Received Unknown packet %d expecting %d\n", recv_type, type);
 #endif
 			gnutls_assert();
 			return GNUTLS_E_UNKNOWN_ERROR;
diff --git a/lib/gnutls_sig_check.c b/lib/gnutls_sig_check.c
index ec249bdfef..4fee917818 100644
--- a/lib/gnutls_sig_check.c
+++ b/lib/gnutls_sig_check.c
@@ -119,7 +119,7 @@ int len;
 
 	if (*hash==-1) {
 #ifdef DEBUG
-		fprintf(stderr, "HASH OID: %s\n", str);
+		_gnutls_log( "HASH OID: %s\n", str);
 #endif
 		gnutls_assert();
 		return GNUTLS_E_UNIMPLEMENTED_FEATURE;
@@ -210,7 +210,7 @@ gnutls_datum* tbs;
 		return GNUTLS_CERT_TRUSTED;
 	}
 #ifdef DEBUG
-	fprintf(stderr, "PK: %d\n", issuer->subject_pk_algorithm);	
+	_gnutls_log( "PK: %d\n", issuer->subject_pk_algorithm);	
 #endif
 
 	gnutls_assert();
diff --git a/lib/gnutls_v2_compat.c b/lib/gnutls_v2_compat.c
index 97fc2dc09b..9099659387 100644
--- a/lib/gnutls_v2_compat.c
+++ b/lib/gnutls_v2_compat.c
@@ -48,17 +48,17 @@ static int SelectSuite_v2(GNUTLS_STATE state, opaque ret[2], char *data,
 	x = _gnutls_remove_unwanted_ciphersuites( state, &ciphers, x);
 
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "Requested cipher suites: \n");
+	_gnutls_log( "Requested cipher suites: \n");
 	for (j = 0; j < datalen; j += 3) {
 		if (data[j] == 0) {	/* only print if in v2 compat mode */
-			fprintf(stderr, "\t%s\n",
+			_gnutls_log( "\t%s\n",
 				_gnutls_cipher_suite_get_name(*
 							      ((GNUTLS_CipherSuite *) & data[j+1])));
 		}
 	}
-	fprintf(stderr, "Supported cipher suites: \n");
+	_gnutls_log( "Supported cipher suites: \n");
 	for (j = 0; j < x; j++)
-		fprintf(stderr, "\t%s\n",
+		_gnutls_log( "\t%s\n",
 			_gnutls_cipher_suite_get_name(ciphers[j]));
 #endif
 	memset(ret, '\0', 2);
@@ -69,9 +69,9 @@ static int SelectSuite_v2(GNUTLS_STATE state, opaque ret[2], char *data,
 				if ( memcmp(ciphers[i].CipherSuite, &data[j+1],
 				     2) == 0) {
 #ifdef HANDSHAKE_DEBUG
-					fprintf(stderr,
+					_gnutls_log(
 						"Selected cipher suite: ");
-					fprintf(stderr, "%s\n",
+					_gnutls_log( "%s\n",
 						_gnutls_cipher_suite_get_name
 						(*
 						 ((GNUTLS_CipherSuite *) &
@@ -118,7 +118,7 @@ int _gnutls_read_client_hello_v2(GNUTLS_STATE state, opaque * data,
 
 	DECR_LEN(len, 2);
 #ifdef HANDSHAKE_DEBUG
-	fprintf(stderr, "V2 Handshake: Client's version: %d.%d\n", data[pos],
+	_gnutls_log( "V2 Handshake: Client's version: %d.%d\n", data[pos],
 		data[pos + 1]);
 #endif
 
@@ -196,7 +196,7 @@ int _gnutls_read_client_hello_v2(GNUTLS_STATE state, opaque * data,
 				    current_cipher_suite));
 	if (state->gnutls_internals.auth_struct == NULL) {
 #ifdef HANDSHAKE_DEBUG
-		fprintf(stderr,
+		_gnutls_log(
 			"V2 Handshake: Cannot find the appropriate handler for the KX algorithm\n");
 #endif
 		gnutls_assert();