postfix-3.5-20191109

postfix/.indent.pro

@@ -20,6 +20,7 @@
 -TBH_TABLE
 -TBINATTR
 -TBINATTR_INFO
+-Tbind_props
 -TBINHASH
 -TBINHASH_INFO
 -TBIO
@@ -37,9 +38,10 @@
 -TBYTE_MASK
 -TCFG_PARSER
 -TCIDR_MATCH
+-Tcipher_probe_t
 -TCLEANUP_REGION
--TCLEANUP_STATE
 -TCLEANUP_STAT_DETAIL
+-TCLEANUP_STATE
 -TCLIENT_LIST
 -TCLNT_STREAM
 -TCONFIG_BOOL_FN_TABLE
@@ -63,9 +65,11 @@
 -TCRYPTO_EX_DATA
 -TCTABLE
 -TCTABLE_ENTRY
+-Td2i_X509_t
+-Tdane_digest
 -TDB_COMMON_CTX
--TDELIVERED_HDR_INFO
 -TDELIVER_ATTR
+-TDELIVERED_HDR_INFO
 -TDELIVER_REQUEST
 -TDELTA_TIME
 -TDICT
@@ -146,7 +150,9 @@
 -TEVP_PKEY
 -TEXPAND_ATTR
 -TFILE
+-Tfilter_ctx
 -TFORWARD_INFO
+-Tgeneral_name_stack_t
 -THBC_ACTION_CALL_BACKS
 -THBC_CALL_BACKS
 -THBC_CHECKS
@@ -158,17 +164,18 @@
 -THOST
 -THTABLE
 -THTABLE_INFO
+-Tiana_digest
 -TINET_ADDR_LIST
 -TINET_PROTO_INFO
 -TINSTANCE
 -TINST_SELECTION
 -TINT32_TYPE
--TINTV
 -TINT_TABLE
+-TINTV
 -TJMP_BUF_WRAPPER
 -TLDAP
--TLDAPMessage
 -TLDAP_CONN
+-TLDAPMessage
 -TLIB_DP
 -TLIB_FN
 -TLMTP_ATTR
@@ -183,13 +190,14 @@
 -TMAC_EXP_OP_INFO
 -TMAC_HEAD
 -TMAC_PARSE
+-TMAI_HOSTADDR_STR
+-TMAI_HOSTNAME_STR
+-TMAIL_ADDR_FORMATTER
 -TMAIL_ADDR_MAP_TEST
 -TMAIL_PRINT
 -TMAIL_SCAN
 -TMAIL_STREAM
 -TMAIL_VERSION
--TMAI_HOSTADDR_STR
--TMAI_HOSTNAME_STR
 -TMAI_SERVNAME_STR
 -TMAI_SERVPORT_STR
 -TMAPS
@@ -208,9 +216,9 @@
 -TMDB_val
 -TMILTER
 -TMILTER8
--TMILTERS
 -TMILTER_MACROS
 -TMILTER_MSG_CONTEXT
+-TMILTERS
 -TMIME_ENCODING
 -TMIME_INFO
 -TMIME_STACK
@@ -235,6 +243,7 @@
 -TNAME_CODE
 -TNAME_MASK
 -TNBBIO
+-Toff_t
 -TOPTIONS
 -TPCF_DBMS_INFO
 -TPCF_EVAL_CTX
@@ -248,6 +257,7 @@
 -TPCF_SERVICE_PATTERN
 -TPCF_STRING_NV
 -TPEER_NAME
+-Tpem_load_state_t
 -TPGSQL_NAME
 -TPICKUP_INFO
 -TPIPE_ATTR
@@ -255,9 +265,9 @@
 -TPIPE_STATE
 -TPLMYSQL
 -TPLPGSQL
--TPOSTMAP_KEY_STATE
 -TPOST_MAIL_FCLOSE_STATE
 -TPOST_MAIL_STATE
+-TPOSTMAP_KEY_STATE
 -TPRIVATE_STR_TABLE
 -TPSC_CALL_BACK_ENTRY
 -TPSC_CLIENT_INFO
@@ -285,11 +295,15 @@
 -TRECIPIENT
 -TRECIPIENT_LIST
 -TREC_TYPE_NAME
+-Tregex_t
+-Tregmatch_t
+-TRES_CONTEXT
 -TRESOLVE_REPLY
 -TRESPONSE
 -TREST_TABLE
--TRES_CONTEXT
 -TRWR_CONTEXT
+-Tsasl_conn_t
+-Tsasl_secret_t
 -TSCACHE
 -TSCACHE_CLNT
 -TSCACHE_MULTI
@@ -304,12 +318,19 @@
 -TSCAN_INFO
 -TSCAN_OBJ
 -TSESSION
+-Tsfsistat
 -TSHARED_PATH
+-Tsigset_t
 -TSINGLE_SERVER
 -TSINK_COMMAND
 -TSINK_STATE
+-Tsize_t
 -TSLMDB
 -TSMFICTX
+-TSM_STATE
+-TSMTP_ADDR
+-TSMTP_CLI_ATTR
+-TSMTP_CMD
 -TSMTPD_CMD
 -TSMTPD_DEFER
 -TSMTPD_ENDPT_LOOKUP_INFO
@@ -321,9 +342,6 @@
 -TSMTPD_STATE
 -TSMTPD_TOKEN
 -TSMTPD_XFORWARD_ATTR
--TSMTP_ADDR
--TSMTP_CLI_ATTR
--TSMTP_CMD
 -TSMTP_ITERATOR
 -TSMTP_RESP
 -TSMTP_SASL_AUTH_CACHE
@@ -332,10 +350,13 @@
 -TSMTP_TLS_POLICY
 -TSMTP_TLS_SESS
 -TSMTP_TLS_SITE_POLICY
--TSM_STATE
+-Tsockaddr
 -TSOCKADDR_SIZE
 -TSPAWN_ATTR
+-Tssize_t
 -TSSL
+-Tssl_cipher_stack_t
+-Tssl_comp_stack_t
 -TSSL_CTX
 -TSSL_SESSION
 -TSTATE
@@ -343,17 +364,20 @@
 -TSTRING_TABLE
 -TSYS_EXITS_DETAIL
 -TTEST_CASE
--TTLSMGR_SCACHE
+-Ttime_t
--TTLSP_STATE
+-Ttlsa_filter
 -TTLS_APPL_STATE
 -TTLS_CERTS
 -TTLS_CLIENT_INIT_PROPS
 -TTLS_CLIENT_PARAMS
 -TTLS_CLIENT_START_PROPS
+-TTLScontext_t
 -TTLS_DANE
+-TTLSMGR_SCACHE
 -TTLS_PKEYS
 -TTLS_PRNG_SEED_INFO
 -TTLS_PRNG_SRC
+-TTLSP_STATE
 -TTLS_ROLE
 -TTLS_SCACHE
 -TTLS_SCACHE_ENTRY
@@ -364,7 +388,6 @@
 -TTLS_TLSA
 -TTLS_USAGE
 -TTLS_VINFO
--TTLScontext_t
 -TTOK822
 -TTRANSPORT_INFO
 -TTRIGGER_SERVER
@@ -377,10 +400,11 @@
 -TWATCHDOG
 -TWATCH_FD
 -TX509
--TX509V3_CTX
 -TX509_EXTENSION
 -TX509_NAME
+-Tx509_stack_t
 -TX509_STORE_CTX
+-TX509V3_CTX
 -TXSASL_CLIENT
 -TXSASL_CLIENT_CREATE_ARGS
 -TXSASL_CLIENT_IMPL
@@ -397,26 +421,3 @@
 -TXSASL_SERVER_CREATE_ARGS
 -TXSASL_SERVER_IMPL
 -TXSASL_SERVER_IMPL_INFO
--Tbind_props
--Tcipher_probe_t
--Td2i_X509_t
--Tdane_digest
--Tfilter_ctx
--Tgeneral_name_stack_t
--Tiana_digest
--Toff_t
--Tpem_load_state_t
--Tregex_t
--Tregmatch_t
--Tsasl_conn_t
--Tsasl_secret_t
--Tsfsistat
--Tsigset_t
--Tsize_t
--Tsockaddr
--Tssize_t
--Tssl_cipher_stack_t
--Tssl_comp_stack_t
--Ttime_t
--Ttlsa_filter
--Tx509_stack_t

postfix/HISTORY

@@ -24451,3 +24451,35 @@ Apologies for any names omitted.
 	(but sending BDAT is still a client error, because postscreen
 	rejects all RCPT commands and does not announce PIPELINING
 	support). File: postscreen/postscreen_smtpd.c.
+
+20190922
+
+	Documentation: replaced the link to "Suite B" cryptography
+	with a link to web.archive.org. File: proto/postconf.proto.
+
+20191109
+
+	Cleanup: Postfix daemon processes now log the from= and to=
+	addresses in external (quoted) form in non-debug logging
+	(info, warning, etc.). This is consistent with the address
+	form that Postfix 3.2 and later prefer for table lookups.
+	It is therefore the more useful form for non-debug logging.
+	Files: cleanup/cleanup.c, cleanup/cleanup_message.c,
+	cleanup/cleanup_milter.c, global/info_log_addr_form.c,
+	global/info_log_addr_form.h, global/log_adhoc.c,
+	global/mail_params.c, global/mail_params.h, global/opened.c,
+	local/local.c, oqmgr/qmgr.c, oqmgr/qmgr_active.c,
+	pickup/pickup.c, pipe/pipe.c, postscreen/postscreen.c,
+	postscreen/postscreen_smtpd.c, proto/postconf.proto,
+	qmgr/qmgr.c, qmgr/qmgr_active.c, smtp/smtp.c, smtpd/smtpd.c,
+	smtpd/smtpd_check.c, virtual/virtual.c.
+
+	Workaround: the parser for key/certificate chain files
+	rejected inputs that contain an EC PARAMETERS object. While
+	this is technically correct (the documentation says what
+	types are allowed) this is surprising behavior because the
+	legacy cert/key parameters will accept such inputs. For
+	now, the parser skips object types that it does not know
+	about for inter-operability, and logs a warning because
+	ignoring inputs is not kosher. Viktor and Wietse. File:
+	tls/tls_certkey.c.

postfix/RELEASE_NOTES

@@ -25,6 +25,31 @@ more recent Eclipse Public License 2.0. Recipients can choose to take
 the software under the license of their choice. Those who are more
 comfortable with the IPL can continue with that license.
 
+Incompatible changes with snapshot 20191109
+===========================================
+
+Postfix daemon processes now log the from= and to= addresses in
+external (quoted) form in non-debug logging (info, warning, etc.).
+This means that when an address localpart contains spaces or other
+special characters, the localpart will be quoted, for example:
+
+    from=<"name with spaces"@example.com>
+
+Older Postfix versions would log the internal (unquoted) form: 
+
+    from=<name with spaces@example.com>
+
+The external and internal forms are identical for the vast majority
+of email addresses that contain no spaces or other special characters
+in the localpart.
+
+Specify "info_log_address_format = internal" for backwards
+compatibility.
+
+The logging in external form is consistent with the address form
+that Postfix 3.2 and later prefer for table lookups. It is therefore
+the more useful form for non-debug logging.
+
 Major changes with snapshot 20190615
 ====================================
 

postfix/html/cleanup.8.html

@@ -489,6 +489,12 @@ CLEANUP(8)                                                          CLEANUP(8)
        <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
               The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The email address form that will be used  in  non-debug  logging
+              (info, warning, etc.).
+
 <b>FILES</b>
        /etc/postfix/canonical*, canonical mapping table
        /etc/postfix/virtual*, virtual mapping table

postfix/html/lmtp.8.html

@@ -355,6 +355,12 @@ SMTP(8)                                                                SMTP(8)
               IPv6 addresses, ensure that the Postfix SMTP client can try both
               address types before it runs into the <a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a>.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The  email  address  form that will be used in non-debug logging
+              (info, warning, etc.).
+
 <b>MIME PROCESSING CONTROLS</b>
        Available in Postfix version 2.0 and later:
 

postfix/html/local.8.html

@@ -575,6 +575,12 @@ LOCAL(8)                                                              LOCAL(8)
        <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
               The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The  email  address  form that will be used in non-debug logging
+              (info, warning, etc.).
+
 <b>FILES</b>
        The following are examples; details differ between systems.
        $HOME/.forward, per-user aliasing

postfix/html/oqmgr.8.html

@@ -380,6 +380,12 @@ OQMGR(8)                                                              OQMGR(8)
        <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
               The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The  email  address  form that will be used in non-debug logging
+              (info, warning, etc.).
+
 <b>FILES</b>
        /var/spool/postfix/incoming, <a href="QSHAPE_README.html#incoming_queue">incoming queue</a>
        /var/spool/postfix/active, <a href="QSHAPE_README.html#active_queue">active queue</a>

postfix/html/pickup.8.html

@@ -97,6 +97,12 @@ PICKUP(8)                                                            PICKUP(8)
        <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
               The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The email address form that will be used  in  non-debug  logging
+              (info, warning, etc.).
+
 <b>SEE ALSO</b>
        <a href="cleanup.8.html">cleanup(8)</a>, message canonicalization
        <a href="sendmail.1.html">sendmail(1)</a>, Sendmail-compatible interface

postfix/html/pipe.8.html

@@ -471,6 +471,12 @@ PIPE(8)                                                                PIPE(8)
        <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
               The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The email address form that will be used  in  non-debug  logging
+              (info, warning, etc.).
+
 <b>SEE ALSO</b>
        <a href="qmgr.8.html">qmgr(8)</a>, queue manager
        <a href="bounce.8.html">bounce(8)</a>, delivery status reports

postfix/html/postconf.5.html

@@ -4042,6 +4042,49 @@ Examples:
 </pre>
 
 
+</DD>
+
+<DT><b><a name="info_log_address_format">info_log_address_format</a>
+(default: external)</b></DT><DD>
+
+<p> The email address form that will be used in non-debug logging
+(info, warning, etc.). As of Postfix 3.5 when an address localpart
+contains spaces or other special characters, the localpart will be
+quoted, for example: </p>
+
+<blockquote>
+<pre>
+    from=&lt;"name with spaces"@example.com&gt;
+</pre>
+</blockquote>
+
+<p> Older Postfix versions would log the internal (unquoted) form: </p>
+
+<blockquote>
+<pre>
+    from=&lt;name with spaces@example.com&gt;
+</pre>
+</blockquote>
+
+<p> The external and internal forms are identical for the vast
+majority of email addresses that contain no spaces or other special
+characters in the localpart. </p>
+
+<p> The logging in external form is consistent with the address
+form that Postfix 3.2 and later prefer for most table lookups. This
+is therefore the more useful form for non-debug logging. </p>
+
+<p> Specify "<b>info_log_address_format = internal</b>" for backwards
+compatibility. </p>
+
+<p> Postfix uses the unquoted form internally, because an attacker
+can specify an email address in different forms by playing games
+with quotes and backslashes. An attacker should not be able to use
+such games to circumvent Postfix access policies. </p>
+
+<p> This feature is available in Postfix 3.5 and later. </p>
+
+
 </DD>
 
 <DT><b><a name="initial_destination_concurrency">initial_destination_concurrency</a>

postfix/html/postscreen.8.html

@@ -409,6 +409,12 @@ POSTSCREEN(8)                                                    POSTSCREEN(8)
        <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
               The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The  email  address  form that will be used in non-debug logging
+              (info, warning, etc.).
+
 <b>SEE ALSO</b>
        <a href="smtpd.8.html">smtpd(8)</a>, Postfix SMTP server
        <a href="tlsproxy.8.html">tlsproxy(8)</a>, Postfix TLS proxy server

postfix/html/qmgr.8.html

@@ -458,6 +458,12 @@ QMGR(8)                                                                QMGR(8)
        <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
               The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The  email  address  form that will be used in non-debug logging
+              (info, warning, etc.).
+
 <b>FILES</b>
        /var/spool/postfix/incoming, <a href="QSHAPE_README.html#incoming_queue">incoming queue</a>
        /var/spool/postfix/active, <a href="QSHAPE_README.html#active_queue">active queue</a>

postfix/html/smtp.8.html

@@ -355,6 +355,12 @@ SMTP(8)                                                                SMTP(8)
               IPv6 addresses, ensure that the Postfix SMTP client can try both
               address types before it runs into the <a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a>.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The  email  address  form that will be used in non-debug logging
+              (info, warning, etc.).
+
 <b>MIME PROCESSING CONTROLS</b>
        Available in Postfix version 2.0 and later:
 

postfix/html/smtpd.8.html

@@ -595,6 +595,12 @@ SMTPD(8)                                                              SMTPD(8)
               A workaround for implementations that hang Postfix while shuting
               down a TLS session, until Postfix times out.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The email address form that will be used  in  non-debug  logging
+              (info, warning, etc.).
+
 <b>OBSOLETE STARTTLS CONTROLS</b>
        The  following  configuration  parameters  exist for compatibility with
        Postfix versions before 2.3. Support for these will  be  removed  in  a

postfix/html/virtual.8.html

@@ -279,6 +279,12 @@ VIRTUAL(8)                                                          VIRTUAL(8)
        <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
               The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
 
+       Available in Postfix 3.5 and later:
+
+       <b>info_log_address_format (external)</b>
+              The  email  address  form that will be used in non-debug logging
+              (info, warning, etc.).
+
 <b>SEE ALSO</b>
        <a href="qmgr.8.html">qmgr(8)</a>, queue manager
        <a href="bounce.8.html">bounce(8)</a>, delivery status reports

postfix/man/man5/postconf.5

@@ -2535,6 +2535,51 @@ inet_protocols = ipv4, ipv6
 .fi
 .ad
 .ft R
+.SH info_log_address_format (default: external)
+The email address form that will be used in non\-debug logging
+(info, warning, etc.). As of Postfix 3.5 when an address localpart
+contains spaces or other special characters, the localpart will be
+quoted, for example:
+.sp
+.in +4
+.nf
+.na
+.ft C
+    from=<"name with spaces"@example.com>
+.fi
+.ad
+.ft R
+.in -4
+.PP
+Older Postfix versions would log the internal (unquoted) form:
+.sp
+.in +4
+.nf
+.na
+.ft C
+    from=<name with spaces@example.com>
+.fi
+.ad
+.ft R
+.in -4
+.PP
+The external and internal forms are identical for the vast
+majority of email addresses that contain no spaces or other special
+characters in the localpart.
+.PP
+The logging in external form is consistent with the address
+form that Postfix 3.2 and later prefer for most table lookups. This
+is therefore the more useful form for non\-debug logging.
+.PP
+Specify "\fBinfo_log_address_format = internal\fR" for backwards
+compatibility.
+.PP
+Postfix uses the unquoted form internally, because an attacker
+can specify an email address in different forms by playing games
+with quotes and backslashes. An attacker should not be able to use
+such games to circumvent Postfix access policies.
+.PP
+This feature is available in Postfix 3.5 and later.
 .SH initial_destination_concurrency (default: 5)
 The initial per\-destination concurrency level for parallel delivery
 to the same destination.

postfix/man/man8/cleanup.8

@@ -432,6 +432,11 @@ aliasing or with canonical mapping).
 Available in Postfix 3.3 and later:
 .IP "\fBservice_name (read\-only)\fR"
 The master.cf service name of a Postfix daemon process.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "FILES"
 .na
 .nf

postfix/man/man8/local.8

@@ -604,6 +604,11 @@ address is rewritten to a different address (for example with
 aliasing or with canonical mapping).
 .IP "\fBservice_name (read\-only)\fR"
 The master.cf service name of a Postfix daemon process.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "FILES"
 .na
 .nf

postfix/man/man8/oqmgr.8

@@ -371,6 +371,11 @@ the sender when the delay clears up.
 Available in Postfix 3.3 and later:
 .IP "\fBservice_name (read\-only)\fR"
 The master.cf service name of a Postfix daemon process.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "FILES"
 .na
 .nf

postfix/man/man8/pickup.8

@@ -105,6 +105,11 @@ records, so that, for example, "smtpd" becomes "prefix/smtpd".
 Available in Postfix 3.3 and later:
 .IP "\fBservice_name (read\-only)\fR"
 The master.cf service name of a Postfix daemon process.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "SEE ALSO"
 .na
 .nf

postfix/man/man8/pipe.8

@@ -449,6 +449,11 @@ address is rewritten to a different address (for example with
 aliasing or with canonical mapping).
 .IP "\fBservice_name (read\-only)\fR"
 The master.cf service name of a Postfix daemon process.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "SEE ALSO"
 .na
 .nf

postfix/man/man8/postscreen.8

@@ -410,6 +410,11 @@ records, so that, for example, "smtpd" becomes "prefix/smtpd".
 Available in Postfix 3.3 and later:
 .IP "\fBservice_name (read\-only)\fR"
 The master.cf service name of a Postfix daemon process.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "SEE ALSO"
 .na
 .nf

postfix/man/man8/qmgr.8

@@ -435,6 +435,11 @@ the sender when the delay clears up.
 Available in Postfix 3.3 and later:
 .IP "\fBservice_name (read\-only)\fR"
 The master.cf service name of a Postfix daemon process.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "FILES"
 .na
 .nf

postfix/man/man8/smtp.8

@@ -347,6 +347,11 @@ Available in Postfix version 3.3 and later:
 When a remote destination resolves to a combination of IPv4 and
 IPv6 addresses, ensure that the Postfix SMTP client can try both
 address types before it runs into the smtp_mx_address_limit.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "MIME PROCESSING CONTROLS"
 .na
 .nf

postfix/man/man8/smtpd.8

@@ -532,6 +532,11 @@ Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later:
 .IP "\fBtls_fast_shutdown_enable (yes)\fR"
 A workaround for implementations that hang Postfix while shuting
 down a TLS session, until Postfix times out.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "OBSOLETE STARTTLS CONTROLS"
 .na
 .nf

postfix/man/man8/virtual.8

@@ -298,6 +298,11 @@ address is rewritten to a different address (for example with
 aliasing or with canonical mapping).
 .IP "\fBservice_name (read\-only)\fR"
 The master.cf service name of a Postfix daemon process.
+.PP
+Available in Postfix 3.5 and later:
+.IP "\fBinfo_log_address_format (external)\fR"
+The email address form that will be used in non\-debug logging
+(info, warning, etc.).
 .SH "SEE ALSO"
 .na
 .nf

postfix/proto/postconf.proto

@@ -12791,7 +12791,7 @@ is unwise to choose an "bleeding-edge" curve supported by only a
 small subset of clients.  </p>
 
 <p> The default "strong" curve is rated in NSA <a
-href="http://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
+href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
 B</a> for information classified up to SECRET.  </p>
 
 <p> Note: elliptic curve names are poorly standardized; different
@@ -12828,7 +12828,7 @@ curve must be implemented by OpenSSL (as reported by ecparam(1) with the
 of RFC 4492. You should not generally change this setting. </p>
 
 <p> This default "ultra" curve is rated in NSA <a
-href="http://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
+href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
 B</a> for information classified up to TOP SECRET. </p>
 
 <p> If you want to take maximal advantage of ciphers that offer <a
@@ -17654,3 +17654,42 @@ default suffix, YYYYMMDD-HHMMSS, allows logs to be rotated frequently.
 </p>
 
 <p> This feature is available in Postfix 3.4 and later. </p>
+
+%PARAM info_log_address_format external
+
+<p> The email address form that will be used in non-debug logging
+(info, warning, etc.). As of Postfix 3.5 when an address localpart
+contains spaces or other special characters, the localpart will be
+quoted, for example: </p>
+
+<blockquote>
+<pre>
+    from=&lt;"name with spaces"@example.com&gt;
+</pre>
+</blockquote>
+
+<p> Older Postfix versions would log the internal (unquoted) form: </p>
+
+<blockquote>
+<pre>
+    from=&lt;name with spaces@example.com&gt;
+</pre>
+</blockquote> 
+
+<p> The external and internal forms are identical for the vast
+majority of email addresses that contain no spaces or other special
+characters in the localpart. </p>
+
+<p> The logging in external form is consistent with the address
+form that Postfix 3.2 and later prefer for most table lookups. This
+is therefore the more useful form for non-debug logging. </p>
+
+<p> Specify "<b>info_log_address_format = internal</b>" for backwards
+compatibility. </p>
+
+<p> Postfix uses the unquoted form internally, because an attacker
+can specify an email address in different forms by playing games
+with quotes and backslashes. An attacker should not be able to use
+such games to circumvent Postfix access policies. </p>
+
+<p> This feature is available in Postfix 3.5 and later. </p>

postfix/src/cleanup/Makefile.in

@@ -1066,6 +1066,7 @@ cleanup_message.o: ../../include/ext_prop.h
 cleanup_message.o: ../../include/header_body_checks.h
 cleanup_message.o: ../../include/header_opts.h
 cleanup_message.o: ../../include/htable.h
+cleanup_message.o: ../../include/info_log_addr_form.h
 cleanup_message.o: ../../include/iostuff.h
 cleanup_message.o: ../../include/is_header.h
 cleanup_message.o: ../../include/lex_822.h
@@ -1110,6 +1111,7 @@ cleanup_milter.o: ../../include/header_body_checks.h
 cleanup_milter.o: ../../include/header_opts.h
 cleanup_milter.o: ../../include/htable.h
 cleanup_milter.o: ../../include/inet_proto.h
+cleanup_milter.o: ../../include/info_log_addr_form.h
 cleanup_milter.o: ../../include/iostuff.h
 cleanup_milter.o: ../../include/is_header.h
 cleanup_milter.o: ../../include/lex_822.h

postfix/src/cleanup/cleanup.c

@@ -400,6 +400,11 @@
 /*	Available in Postfix 3.3 and later:
 /* .IP "\fBservice_name (read-only)\fR"
 /*	The master.cf service name of a Postfix daemon process.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* FILES
 /*	/etc/postfix/canonical*, canonical mapping table
 /*	/etc/postfix/virtual*, virtual mapping table

postfix/src/cleanup/cleanup_message.c

@@ -88,6 +88,7 @@
 #include <lex_822.h>
 #include <dsn_util.h>
 #include <conv_time.h>
+#include <info_log_addr_form.h>
 
 /* Application-specific. */
 
@@ -263,9 +264,11 @@ static void cleanup_act_log(CLEANUP_STATE *state,
     vstring_sprintf(state->temp1, "%s: %s: %s %.200s from %s;",
 		    state->queue_id, action, class, content, attr);
     if (state->sender)
-	vstring_sprintf_append(state->temp1, " from=<%s>", state->sender);
+	vstring_sprintf_append(state->temp1, " from=<%s>",
+			       info_log_addr_form_sender(state->sender));
     if (state->recip)
-	vstring_sprintf_append(state->temp1, " to=<%s>", state->recip);
+	vstring_sprintf_append(state->temp1, " to=<%s>",
+			       info_log_addr_form_recipient(state->recip));
     if ((attr = nvtable_find(state->attr, MAIL_ATTR_LOG_PROTO_NAME)) != 0)
 	vstring_sprintf_append(state->temp1, " proto=%s", attr);
     if ((attr = nvtable_find(state->attr, MAIL_ATTR_LOG_HELO_NAME)) != 0)
@@ -1024,7 +1027,9 @@ static void cleanup_mime_error_callback(void *context, int err_code,
 #define TEXT_LEN (len < 100 ? (int) len : 100)
 	msg_info("%s: reject: mime-error %s: %.*s from %s; from=<%s> to=<%s>",
 		 state->queue_id, mime_state_error(err_code), TEXT_LEN, text,
-	    origin, state->sender, state->recip ? state->recip : "unknown");
+		 origin, info_log_addr_form_sender(state->sender),
+		 info_log_addr_form_recipient(state->recip ?
+					      state->recip : "unknown"));
     }
 }
 

postfix/src/cleanup/cleanup_milter.c

@@ -113,6 +113,7 @@
 #include <quote_821_local.h>
 #include <dsn_util.h>
 #include <xtext.h>
+#include <info_log_addr_form.h>
 
 /* Application-specific. */
 
@@ -240,9 +241,11 @@ static void cleanup_milter_hbc_log(void *context, const char *action,
 		    state->queue_id, where, action, where, line,
 		    state->client_name, state->client_addr);
     if (state->sender)
-	vstring_sprintf_append(state->temp1, " from=<%s>", state->sender);
+	vstring_sprintf_append(state->temp1, " from=<%s>",
+			       info_log_addr_form_sender(state->sender));
     if (state->recip)
-	vstring_sprintf_append(state->temp1, " to=<%s>", state->recip);
+	vstring_sprintf_append(state->temp1, " to=<%s>",
+			       info_log_addr_form_recipient(state->recip));
     if ((attr = nvtable_find(state->attr, MAIL_ATTR_LOG_PROTO_NAME)) != 0)
 	vstring_sprintf_append(state->temp1, " proto=%s", attr);
     if ((attr = nvtable_find(state->attr, MAIL_ATTR_LOG_HELO_NAME)) != 0)
@@ -2056,9 +2059,11 @@ static const char *cleanup_milter_apply(CLEANUP_STATE *state, const char *event,
 		    state->queue_id, action, event, state->client_name,
 		    state->client_addr, text);
     if (state->sender)
-	vstring_sprintf_append(state->temp1, " from=<%s>", state->sender);
+	vstring_sprintf_append(state->temp1, " from=<%s>",
+			       info_log_addr_form_sender(state->sender));
     if (state->recip)
-	vstring_sprintf_append(state->temp1, " to=<%s>", state->recip);
+	vstring_sprintf_append(state->temp1, " to=<%s>",
+			       info_log_addr_form_recipient(state->recip));
     if ((attr = nvtable_find(state->attr, MAIL_ATTR_LOG_PROTO_NAME)) != 0)
 	vstring_sprintf_append(state->temp1, " proto=%s", attr);
     if ((attr = nvtable_find(state->attr, MAIL_ATTR_LOG_HELO_NAME)) != 0)

postfix/src/global/Makefile.in

@@ -35,7 +35,8 @@ SRCS	= abounce.c anvil_clnt.c been_here.c bounce.c bounce_log.c \
 	mkmap_fail.c haproxy_srvr.c dsn_filter.c dynamicmaps.c uxtext.c \
 	smtputf8.c mail_conf_over.c mail_parm_split.c midna_adomain.c \
 	mail_addr_form.c quote_flags.c maillog_client.c \
-	normalize_mailhost_addr.c map_search.c reject_deliver_request.c
+	normalize_mailhost_addr.c map_search.c reject_deliver_request.c \
+	info_log_addr_form.c
 OBJS	= abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \
 	canon_addr.o cfg_parser.o cleanup_strerror.o cleanup_strflags.o \
 	clnt_stream.o conv_time.o db_common.o debug_peer.o debug_process.o \
@@ -72,7 +73,8 @@ OBJS	= abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \
 	mkmap_fail.o haproxy_srvr.o dsn_filter.o dynamicmaps.o uxtext.o \
 	smtputf8.o attr_override.o mail_parm_split.o midna_adomain.o \
 	$(NON_PLUGIN_MAP_OBJ) mail_addr_form.o quote_flags.o maillog_client.o \
-	normalize_mailhost_addr.o map_search.o reject_deliver_request.o
+	normalize_mailhost_addr.o map_search.o reject_deliver_request.o \
+	info_log_addr_form.o
 # MAP_OBJ is for maps that may be dynamically loaded with dynamicmaps.cf.
 # When hard-linking these maps, makedefs sets NON_PLUGIN_MAP_OBJ=$(MAP_OBJ),
 # otherwise it sets the PLUGIN_* macros.
@@ -106,7 +108,8 @@ HDRS	= abounce.h anvil_clnt.h been_here.h bounce.h bounce_log.h \
 	verify_sender_addr.h dict_memcache.h memcache_proto.h server_acl.h \
 	haproxy_srvr.h dsn_filter.h dynamicmaps.h uxtext.h smtputf8.h \
 	attr_override.h mail_parm_split.h midna_adomain.h mail_addr_form.h \
-	maillog_client.h normalize_mailhost_addr.h map_search.h
+	maillog_client.h normalize_mailhost_addr.h map_search.h \
+	info_log_addr_form.h
 TESTSRC	= rec2stream.c stream2rec.c recdump.c
 DEFS	= -I. -I$(INC_DIR) -D$(SYSTYPE)
 CFLAGS	= $(DEBUG) $(OPT) $(DEFS)
@@ -1444,6 +1447,15 @@ header_token.o: ../../include/vstring.h
 header_token.o: header_token.c
 header_token.o: header_token.h
 header_token.o: lex_822.h
+info_log_addr_form.o: ../../include/check_arg.h
+info_log_addr_form.o: ../../include/sys_defs.h
+info_log_addr_form.o: ../../include/vbuf.h
+info_log_addr_form.o: ../../include/vstring.h
+info_log_addr_form.o: info_log_addr_form.c
+info_log_addr_form.o: info_log_addr_form.h
+info_log_addr_form.o: mail_addr_form.h
+info_log_addr_form.o: quote_822_local.h
+info_log_addr_form.o: quote_flags.h
 input_transp.o: ../../include/check_arg.h
 input_transp.o: ../../include/msg.h
 input_transp.o: ../../include/name_mask.h
@@ -1487,6 +1499,7 @@ log_adhoc.o: ../../include/vbuf.h
 log_adhoc.o: ../../include/vstream.h
 log_adhoc.o: ../../include/vstring.h
 log_adhoc.o: dsn.h
+log_adhoc.o: info_log_addr_form.h
 log_adhoc.o: log_adhoc.c
 log_adhoc.o: log_adhoc.h
 log_adhoc.o: mail_params.h
@@ -2288,6 +2301,7 @@ opened.o: ../../include/msg.h
 opened.o: ../../include/sys_defs.h
 opened.o: ../../include/vbuf.h
 opened.o: ../../include/vstring.h
+opened.o: info_log_addr_form.h
 opened.o: opened.c
 opened.o: opened.h
 own_inet_addr.o: ../../include/check_arg.h

postfix/src/global/info_log_addr_form.c

@@ -0,0 +1,124 @@
+/*++
+/* NAME
+/*	info_log_addr_form 3
+/* SUMMARY
+/*	format internal-form information for info logging
+/* SYNOPSIS
+/*	#include <info_log_addr_form.h>
+/*
+/*	const char *info_log_addr_form_recipient(
+/*	const char *recipient_addr)
+/*
+/*	const char *info_log_addr_form_sender_addr(
+/*	const char *sender_addr)
+/* DESCRIPTION
+/*	info_log_addr_form_recipient() and info_log_addr_form_sender_addr()
+/*	format an internal-form recipient or sender email address
+/*	for non-debug logging. Each function has its own private
+/*	buffer. Each call overwrites the result from a previous call.
+/*
+/*	Note: the empty address is passed unchanged; it is not
+/*	formatted as "".
+/* .IP recipient_addr
+/* .IP *sender_addr
+/*	An internal-form email address.
+/* LICENSE
+/* .ad
+/* .fi
+/*	The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/*	Wietse Venema
+/*	Google, Inc.
+/*	111 8th Avenue
+/*	New York, NY 10011, USA
+/*--*/
+
+ /*
+  * System library.
+  */
+#include <sys_defs.h>
+
+ /*
+  * Utility library.
+  */
+#include <msg.h>
+#include <name_code.h>
+#include <vstring.h>
+
+ /*
+  * Global library.
+  */
+#include <info_log_addr_form.h>
+#include <mail_addr_form.h>
+#include <mail_params.h>
+#include <quote_822_local.h>
+
+#define INFO_LOG_ADDR_FORM_VAL_NOT_SET	0
+#define INFO_LOG_ADDR_FORM_VAL_INTERNAL	1
+#define INFO_LOG_ADDR_FORM_VAL_EXTERNAL	2
+
+/* Format for info logging. */
+
+int     info_log_addr_form_form = INFO_LOG_ADDR_FORM_VAL_NOT_SET;
+
+#define STR(x)	vstring_str(x)
+
+/* info_log_addr_form_init - one-time initialization */
+
+static void info_log_addr_form_init(void)
+{
+    static NAME_CODE info_log_addr_form_table[] = {
+	INFO_LOG_ADDR_FORM_NAME_EXTERNAL, INFO_LOG_ADDR_FORM_VAL_EXTERNAL,
+	INFO_LOG_ADDR_FORM_NAME_INTERNAL, INFO_LOG_ADDR_FORM_VAL_INTERNAL,
+	0, INFO_LOG_ADDR_FORM_VAL_NOT_SET,
+    };
+    info_log_addr_form_form = name_code(info_log_addr_form_table,
+					NAME_CODE_FLAG_NONE,
+					var_info_log_addr_form);
+
+    if (info_log_addr_form_form == INFO_LOG_ADDR_FORM_VAL_NOT_SET)
+	msg_fatal("invalid parameter setting \"%s = %s\"",
+		  VAR_INFO_LOG_ADDR_FORM, var_info_log_addr_form);
+}
+
+/* info_log_addr_form - format an email address for info logging */
+
+static VSTRING *info_log_addr_form(VSTRING *buf, const char *addr)
+{
+    const char myname[] = "info_log_addr_form";
+
+    if (buf == 0)
+	buf = vstring_alloc(100);
+    if (info_log_addr_form_form == INFO_LOG_ADDR_FORM_VAL_NOT_SET)
+	info_log_addr_form_init();
+    if (*addr == 0
+	|| info_log_addr_form_form == INFO_LOG_ADDR_FORM_VAL_INTERNAL) {
+	vstring_strcpy(buf, addr);
+    } else if (info_log_addr_form_form == INFO_LOG_ADDR_FORM_VAL_EXTERNAL) {
+	quote_822_local(buf, addr);
+    } else {
+	msg_panic("%s: bad format type: %d",
+		  myname, info_log_addr_form_form);
+    }
+    return (buf);
+}
+
+/* info_log_addr_form_recipient - format a recipient address for info logging */
+
+const char *info_log_addr_form_recipient(const char *recipient_addr)
+{
+    static VSTRING *recipient_buffer = 0;
+
+    recipient_buffer = info_log_addr_form(recipient_buffer, recipient_addr);
+    return (STR(recipient_buffer));
+}
+
+/* info_log_addr_form_sender - format a sender address for info logging */
+
+const char *info_log_addr_form_sender(const char *sender_addr)
+{
+    static VSTRING *sender_buffer = 0;
+
+    sender_buffer = info_log_addr_form(sender_buffer, sender_addr);
+    return (STR(sender_buffer));
+}

postfix/src/global/info_log_addr_form.h

@@ -0,0 +1,31 @@
+#ifndef _INFO_LOG_ADDR_FORM_H_INCLUDED_
+#define _INFO_LOG_ADDR_FORM_H_INCLUDED_
+
+/*++
+/* NAME
+/*	info_log_addr_form 3h
+/* SUMMARY
+/*	format mail address for info logging
+/* SYNOPSIS
+/*	#include <info_log_addr_form.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+  * External interface.
+  */
+extern const char *info_log_addr_form_recipient(const char *);
+extern const char *info_log_addr_form_sender(const char *);
+
+/* LICENSE
+/* .ad
+/* .fi
+/*	The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/*	Wietse Venema
+/*	Google, Inc.
+/*	111 8th Avenue
+/*	New York, NY 10011, USA
+/*--*/
+
+#endif

postfix/src/global/log_adhoc.c

@@ -27,9 +27,8 @@
 /*	Time stamps from different message delivery stages
 /*	and session reuse count.
 /* .IP recipient
-/*	Recipient information. See recipient_list(3).
+/*	Recipient information, see recipient_list(3). The address
-/* .IP sender
+/*	is formatted by the info_log_addr_form(3) routines.
-/*	The sender envelope address.
 /* .IP relay
 /*	Host we could (not) talk to.
 /* .IP status
@@ -48,6 +47,11 @@
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
+/*
+/*	Wietse Venema
+/*	Google, Inc.
+/*	111 8th Avenue
+/*	New York, NY 10011, USA
 /*--*/
 
 /* System library. */
@@ -66,6 +70,7 @@
 
 #include <log_adhoc.h>
 #include <mail_params.h>
+#include <info_log_addr_form.h>
 
  /*
   * Don't use "struct timeval" for time differences; use explicit signed
@@ -103,10 +108,12 @@ void    log_adhoc(const char *id, MSG_STATS *stats, RECIPIENT *recipient,
      * First, critical information that identifies the nature of the
      * transaction.
      */
-    vstring_sprintf(buf, "%s: to=<%s>", id, recipient->address);
+    vstring_sprintf(buf, "%s: to=<%s>", id,
+		    info_log_addr_form_recipient(recipient->address));
     if (recipient->orig_addr && *recipient->orig_addr
 	&& strcasecmp_utf8(recipient->address, recipient->orig_addr) != 0)
-	vstring_sprintf_append(buf, ", orig_to=<%s>", recipient->orig_addr);
+	vstring_sprintf_append(buf, ", orig_to=<%s>",
+			info_log_addr_form_recipient(recipient->orig_addr));
     vstring_sprintf_append(buf, ", relay=%s", relay);
     if (stats->reuse_count > 0)
 	vstring_sprintf_append(buf, ", conn_use=%d", stats->reuse_count + 1);

postfix/src/global/mail_params.c

@@ -131,6 +131,7 @@
 /*	int     var_idna2003_compat;
 /*	int     var_compat_level;
 /*	char	*var_drop_hdrs;
+/*	char	*var_info_log_addr_form;
 /*	bool	var_enable_orcpt;
 /*
 /*	void	mail_params_init()
@@ -352,6 +353,7 @@ char   *var_smtputf8_autoclass;
 int     var_idna2003_compat;
 int     var_compat_level;
 char   *var_drop_hdrs;
+char   *var_info_log_addr_form;
 bool    var_enable_orcpt;
 
 char	*var_maillog_file;
@@ -759,6 +761,7 @@ void    mail_params_init()
 	VAR_DSN_FILTER, DEF_DSN_FILTER, &var_dsn_filter, 0, 0,
 	VAR_SMTPUTF8_AUTOCLASS, DEF_SMTPUTF8_AUTOCLASS, &var_smtputf8_autoclass, 1, 0,
 	VAR_DROP_HDRS, DEF_DROP_HDRS, &var_drop_hdrs, 0, 0,
+	VAR_INFO_LOG_ADDR_FORM, DEF_INFO_LOG_ADDR_FORM, &var_info_log_addr_form, 1, 0,
 	0,
     };
     static const CONFIG_STR_FN_TABLE function_str_defaults_2[] = {

postfix/src/global/mail_params.h

@@ -4192,6 +4192,16 @@ extern char *var_postlog_service;
 #define DEF_POSTLOGD_WATCHDOG	"10s"
 extern int var_postlogd_watchdog;
 
+ /*
+  * Backwards compatibility for internal-form address logging.
+  */
+#define INFO_LOG_ADDR_FORM_NAME_EXTERNAL	"external"
+#define INFO_LOG_ADDR_FORM_NAME_INTERNAL	"internal"
+
+#define VAR_INFO_LOG_ADDR_FORM	"info_log_address_format"
+#define DEF_INFO_LOG_ADDR_FORM	INFO_LOG_ADDR_FORM_NAME_EXTERNAL
+extern char *var_info_log_addr_form;
+
 /* LICENSE
 /* .ad
 /* .fi

postfix/src/global/mail_version.h

@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20191019"
+#define MAIL_RELEASE_DATE	"20191109"
 #define MAIL_VERSION_NUMBER	"3.5"
 
 #ifdef SNAPSHOT

postfix/src/global/opened.c

@@ -42,6 +42,11 @@
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
+/*
+/*	Wietse Venema
+/*	Google, Inc.
+/*	111 8th Avenue
+/*	New York, NY 10011, USA
 /*--*/
 
 /* System library. */
@@ -57,7 +62,8 @@
 
 /* Global library. */
 
-#include "opened.h"
+#include <opened.h>
+#include <info_log_addr_form.h>
 
 /* opened - log that a message was opened */
 
@@ -82,7 +88,7 @@ void    vopened(const char *queue_id, const char *sender, long size, int nrcpt,
 
     vstring_vsprintf(text, fmt, ap);
     msg_info("%s: from=<%s>, size=%ld, nrcpt=%d%s%s%s",
-	     queue_id, sender, size, nrcpt,
+	     queue_id, info_log_addr_form_sender(sender), size, nrcpt,
 	     *TEXT ? " (" : "", TEXT, *TEXT ? ")" : "");
     vstring_free(text);
 }

postfix/src/local/local.c

@@ -560,6 +560,11 @@
 /*	aliasing or with canonical mapping).
 /* .IP "\fBservice_name (read-only)\fR"
 /*	The master.cf service name of a Postfix daemon process.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* FILES
 /*	The following are examples; details differ between systems.
 /*	$HOME/.forward, per-user aliasing

postfix/src/oqmgr/Makefile.in

@@ -106,6 +106,7 @@ qmgr_active.o: ../../include/dsn_buf.h
 qmgr_active.o: ../../include/dsn_mask.h
 qmgr_active.o: ../../include/events.h
 qmgr_active.o: ../../include/htable.h
+qmgr_active.o: ../../include/info_log_addr_form.h
 qmgr_active.o: ../../include/mail_open_ok.h
 qmgr_active.o: ../../include/mail_params.h
 qmgr_active.o: ../../include/mail_queue.h

postfix/src/oqmgr/qmgr.c

@@ -333,6 +333,11 @@
 /*	Available in Postfix 3.3 and later:
 /* .IP "\fBservice_name (read-only)\fR"
 /*	The master.cf service name of a Postfix daemon process.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* FILES
 /*	/var/spool/postfix/incoming, incoming queue
 /*	/var/spool/postfix/active, active queue

postfix/src/oqmgr/qmgr_active.c

@@ -70,6 +70,11 @@
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
+/*
+/*	Wietse Venema
+/*	Google, Inc.
+/*	111 8th Avenue
+/*	New York, NY 10011, USA
 /*--*/
 
 /* System library. */
@@ -107,6 +112,7 @@
 #include <abounce.h>
 #include <rec_type.h>
 #include <qmgr_user.h>
+#include <info_log_addr_form.h>
 
 /* Application-specific. */
 
@@ -439,7 +445,7 @@ static void qmgr_active_done_25_generic(QMGR_MESSAGE *message)
 	if (event_time() >= message->create_time +
 	    (*message->sender ? var_max_queue_time : var_dsn_queue_time)) {
 	    msg_info("%s: from=<%s>, status=expired, returned to sender",
-		     message->queue_id, message->sender);
+	     message->queue_id, info_log_addr_form_sender(message->sender));
 	    if (message->verp_delims == 0 || var_verp_bounce_off)
 		adefer_flush(BOUNCE_FLAG_KEEP,
 			     message->queue_name,

postfix/src/pickup/Makefile.in

@@ -63,6 +63,7 @@ pickup.o: ../../include/attr.h
 pickup.o: ../../include/check_arg.h
 pickup.o: ../../include/cleanup_user.h
 pickup.o: ../../include/htable.h
+pickup.o: ../../include/info_log_addr_form.h
 pickup.o: ../../include/input_transp.h
 pickup.o: ../../include/iostuff.h
 pickup.o: ../../include/lex_822.h

postfix/src/pickup/pickup.c

@@ -85,6 +85,11 @@
 /*	Available in Postfix 3.3 and later:
 /* .IP "\fBservice_name (read-only)\fR"
 /*	The master.cf service name of a Postfix daemon process.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* SEE ALSO
 /*	cleanup(8), message canonicalization
 /*	sendmail(1), Sendmail-compatible interface
@@ -151,6 +156,7 @@
 #include <rec_attr_map.h>
 #include <mail_version.h>
 #include <smtputf8.h>
+#include <info_log_addr_form.h>
 
 /* Single-threaded server skeleton. */
 
@@ -364,12 +370,12 @@ static int pickup_copy(VSTREAM *qfile, VSTREAM *cleanup,
 
     if (MAIL_IS_REQUEUED(info)) {
 	msg_info("%s: uid=%d from=<%s> orig_id=%s", info->id,
-		 (int) info->st.st_uid, info->sender,
+	     (int) info->st.st_uid, info_log_addr_form_sender(info->sender),
 		 ((name = strrchr(info->path, '/')) != 0 ?
 		  name + 1 : info->path));
     } else {
 	msg_info("%s: uid=%d from=<%s>", info->id,
-		 (int) info->st.st_uid, info->sender);
+	    (int) info->st.st_uid, info_log_addr_form_sender(info->sender));
     }
 
     /*

postfix/src/pipe/pipe.c

@@ -427,6 +427,11 @@
 /*	aliasing or with canonical mapping).
 /* .IP "\fBservice_name (read-only)\fR"
 /*	The master.cf service name of a Postfix daemon process.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* SEE ALSO
 /*	qmgr(8), queue manager
 /*	bounce(8), delivery status reports

postfix/src/postscreen/Makefile.in

@@ -315,6 +315,7 @@ postscreen_smtpd.o: ../../include/dns.h
 postscreen_smtpd.o: ../../include/ehlo_mask.h
 postscreen_smtpd.o: ../../include/events.h
 postscreen_smtpd.o: ../../include/htable.h
+postscreen_smtpd.o: ../../include/info_log_addr_form.h
 postscreen_smtpd.o: ../../include/iostuff.h
 postscreen_smtpd.o: ../../include/is_header.h
 postscreen_smtpd.o: ../../include/lex_822.h

postfix/src/postscreen/postscreen.c

@@ -370,6 +370,11 @@
 /*	Available in Postfix 3.3 and later:
 /* .IP "\fBservice_name (read-only)\fR"
 /*	The master.cf service name of a Postfix daemon process.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* SEE ALSO
 /*	smtpd(8), Postfix SMTP server
 /*	tlsproxy(8), Postfix TLS proxy server

postfix/src/postscreen/postscreen_smtpd.c

@@ -164,6 +164,7 @@
 #include <maps.h>
 #include <ehlo_mask.h>
 #include <lex_822.h>
+#include <info_log_addr_form.h>
 
 /* TLS library. */
 
@@ -574,7 +575,8 @@ static int psc_rcpt_cmd(PSC_STATE *state, char *args)
 	     (int) strlen(state->rcpt_reply) - 2,
 	     var_soft_bounce == 0 ? state->rcpt_reply :
 	     psc_soften_reply(state->rcpt_reply),
-	     state->sender, addr, state->protocol,
+	     info_log_addr_form_sender(state->sender),
+	     info_log_addr_form_recipient(addr), state->protocol,
 	     state->helo_name ? state->helo_name : "");
     return (PSC_SEND_REPLY(state, state->rcpt_reply));
 }

postfix/src/qmgr/Makefile.in

@@ -108,6 +108,7 @@ qmgr_active.o: ../../include/dsn_buf.h
 qmgr_active.o: ../../include/dsn_mask.h
 qmgr_active.o: ../../include/events.h
 qmgr_active.o: ../../include/htable.h
+qmgr_active.o: ../../include/info_log_addr_form.h
 qmgr_active.o: ../../include/mail_open_ok.h
 qmgr_active.o: ../../include/mail_params.h
 qmgr_active.o: ../../include/mail_queue.h

postfix/src/qmgr/qmgr.c

@@ -395,6 +395,11 @@
 /*	Available in Postfix 3.3 and later:
 /* .IP "\fBservice_name (read-only)\fR"
 /*	The master.cf service name of a Postfix daemon process.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* FILES
 /*	/var/spool/postfix/incoming, incoming queue
 /*	/var/spool/postfix/active, active queue

postfix/src/qmgr/qmgr_active.c

@@ -70,6 +70,11 @@
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
+/*
+/*	Wietse Venema
+/*	Google, Inc.
+/*	111 8th Avenue
+/*	New York, NY 10011, USA
 /*--*/
 
 /* System library. */
@@ -107,6 +112,7 @@
 #include <abounce.h>
 #include <rec_type.h>
 #include <qmgr_user.h>
+#include <info_log_addr_form.h>
 
 /* Application-specific. */
 
@@ -439,7 +445,7 @@ static void qmgr_active_done_25_generic(QMGR_MESSAGE *message)
 	if (event_time() >= message->create_time +
 	    (*message->sender ? var_max_queue_time : var_dsn_queue_time)) {
 	    msg_info("%s: from=<%s>, status=expired, returned to sender",
-		     message->queue_id, message->sender);
+	     message->queue_id, info_log_addr_form_sender(message->sender));
 	    if (message->verp_delims == 0 || var_verp_bounce_off)
 		adefer_flush(BOUNCE_FLAG_KEEP,
 			     message->queue_name,

postfix/src/smtp/smtp.c

@@ -321,6 +321,11 @@
 /*	When a remote destination resolves to a combination of IPv4 and
 /*	IPv6 addresses, ensure that the Postfix SMTP client can try both
 /*	address types before it runs into the smtp_mx_address_limit.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* MIME PROCESSING CONTROLS
 /* .ad
 /* .fi

postfix/src/smtpd/Makefile.in

@@ -195,6 +195,7 @@ smtpd.o: ../../include/events.h
 smtpd.o: ../../include/flush_clnt.h
 smtpd.o: ../../include/htable.h
 smtpd.o: ../../include/inet_proto.h
+smtpd.o: ../../include/info_log_addr_form.h
 smtpd.o: ../../include/input_transp.h
 smtpd.o: ../../include/iostuff.h
 smtpd.o: ../../include/is_header.h
@@ -322,6 +323,7 @@ smtpd_check.o: ../../include/fsspace.h
 smtpd_check.o: ../../include/htable.h
 smtpd_check.o: ../../include/inet_addr_list.h
 smtpd_check.o: ../../include/inet_proto.h
+smtpd_check.o: ../../include/info_log_addr_form.h
 smtpd_check.o: ../../include/input_transp.h
 smtpd_check.o: ../../include/iostuff.h
 smtpd_check.o: ../../include/ip_match.h

postfix/src/smtpd/smtpd.c

@@ -498,6 +498,11 @@
 /* .IP "\fBtls_fast_shutdown_enable (yes)\fR"
 /*	A workaround for implementations that hang Postfix while shuting
 /*	down a TLS session, until Postfix times out.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* OBSOLETE STARTTLS CONTROLS
 /* .ad
 /* .fi
@@ -1221,6 +1226,7 @@
 #include <smtputf8.h>
 #include <match_parent_style.h>
 #include <normalize_mailhost_addr.h>
+#include <info_log_addr_form.h>
 
 /* Single-threaded server skeleton. */
 
@@ -1584,9 +1590,11 @@ static const char *smtpd_whatsup(SMTPD_STATE *state)
     else
 	VSTRING_RESET(buf);
     if (state->sender)
-	vstring_sprintf_append(buf, " from=<%s>", state->sender);
+	vstring_sprintf_append(buf, " from=<%s>",
+			       info_log_addr_form_sender(state->sender));
     if (state->recipient)
-	vstring_sprintf_append(buf, " to=<%s>", state->recipient);
+	vstring_sprintf_append(buf, " to=<%s>",
+			    info_log_addr_form_recipient(state->recipient));
     if (state->protocol)
 	vstring_sprintf_append(buf, " proto=%s", state->protocol);
     if (state->helo_name)

postfix/src/smtpd/smtpd_check.c

@@ -252,6 +252,7 @@
 #include <smtp_stream.h>
 #include <attr_override.h>
 #include <map_search.h>
+#include <info_log_addr_form.h>
 
 /* Application-specific. */
 
@@ -995,9 +996,11 @@ static void log_whatsup(SMTPD_STATE *state, const char *whatsup,
 		    state->queue_id ? state->queue_id : "NOQUEUE",
 		    whatsup, state->where, state->namaddr, text);
     if (state->sender)
-	vstring_sprintf_append(buf, " from=<%s>", state->sender);
+	vstring_sprintf_append(buf, " from=<%s>",
+			       info_log_addr_form_sender(state->sender));
     if (state->recipient)
-	vstring_sprintf_append(buf, " to=<%s>", state->recipient);
+	vstring_sprintf_append(buf, " to=<%s>",
+			    info_log_addr_form_recipient(state->recipient));
     if (state->protocol)
 	vstring_sprintf_append(buf, " proto=%s", state->protocol);
     if (state->helo_name)
@@ -5619,6 +5622,7 @@ char   *var_unk_addr_tf_act;
 char   *var_unv_rcpt_tf_act;
 char   *var_unv_from_tf_act;
 char   *var_smtpd_acl_perm_log;
+char   *var_info_log_addr_form;
 
 typedef struct {
     char   *name;
@@ -5674,6 +5678,7 @@ static const STRING_TABLE string_table[] = {
     /* XXX Can't use ``$name'' type default values above. */
     VAR_SMTPD_ACL_PERM_LOG, DEF_SMTPD_ACL_PERM_LOG, &var_smtpd_acl_perm_log,
     VAR_SMTPD_DNS_RE_FILTER, DEF_SMTPD_DNS_RE_FILTER, &var_smtpd_dns_re_filter,
+    VAR_INFO_LOG_ADDR_FORM, DEF_INFO_LOG_ADDR_FORM, &var_info_log_addr_form,
     0,
 };
 
@@ -5706,7 +5711,7 @@ static int string_update(char **argv)
  /*
   * Integer parameters.
   */
-int     var_queue_minfree;		/* XXX use off_t */
+long    var_queue_minfree;		/* XXX use off_t */
 typedef struct {
     char   *name;
     int     defval;

postfix/src/tls/tls_certkey.c

@@ -418,8 +418,7 @@ static int load_pem_object(pem_load_state_t *st)
 		   && strcmp(name, PEM_STRING_DSA) == 0)) {
 	load_pkey(st, pkey_type, buf, buflen);
     } else if (!st->mixed) {
-	msg_warn("error loading %s: unexpected PEM type: %s", st->source, name);
+       msg_warn("loading %s: ignoring PEM type: %s", st->source, name);
-	st->state = PEM_LOAD_STATE_NOGO;
     }
     OPENSSL_free(name);
     OPENSSL_free(header);

postfix/src/virtual/virtual.c

@@ -262,6 +262,11 @@
 /*	aliasing or with canonical mapping).
 /* .IP "\fBservice_name (read-only)\fR"
 /*	The master.cf service name of a Postfix daemon process.
+/* .PP
+/*	Available in Postfix 3.5 and later:
+/* .IP "\fBinfo_log_address_format (external)\fR"
+/*	The email address form that will be used in non-debug logging
+/*	(info, warning, etc.).
 /* SEE ALSO
 /*	qmgr(8), queue manager
 /*	bounce(8), delivery status reports