SSL_SET_INCO...TREAM_POLICY(3ossl)

💅 SSL_SET_INCOMING_STREAM_POLICY (3ossl) — the OpenSSL one, bestie

okay so this is one of those 3ossl man pages, and it's all about the QUIC incoming stream policy. lowkey niche but highkey important if you're doing QUIC things 🦋

---

✨ NAME ✨

SSL_set_incoming_stream_policy, SSL_INCOMING_STREAM_POLICY_AUTO, SSL_INCOMING_STREAM_POLICY_ACCEPT, SSL_INCOMING_STREAM_POLICY_REJECT — these are the girlypops that manage the QUIC incoming stream policy ✨

---

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

#define SSL_INCOMING_STREAM_POLICY_AUTO
#define SSL_INCOMING_STREAM_POLICY_ACCEPT
#define SSL_INCOMING_STREAM_POLICY_REJECT

int SSL_set_incoming_stream_policy(SSL *conn, int policy,
                                          uint64_t app_error_code);

---

💖 DESCRIPTION 💖

So SSL_set_incoming_stream_policy() changes the incoming stream policy for a QUIC connection, and honestly it's giving gatekeeper energy. Depending on which policy you've got configured, OpenSSL QUIC may just automatically reject incoming streams that the peer initiated. The whole point? To make sure that legacy applications — the ones doing single-stream operation with a default stream on a QUIC connection SSL object — don't get handed remotely-initiated streams by a peer that those apps are simply not prepared to handle. like, respect the boundaries, fr fr 🙈

app_error_code is an application error code, and it gets used in any QUIC STOP_SENDING or RESET_STREAM frames generated to actually implement the policy. The default application error code is 0.

The valid values for policy are:

• SSL_INCOMING_STREAM_POLICY_AUTO — this is the default setting, the main character of the trio 👑. Incoming streams get accepted according to these rules:
  • If the default stream mode (configured with SSL_set_default_stream_mode(3)) is set to SSL_DEFAULT_STREAM_MODE_AUTO_BIDI (which is the default) or SSL_DEFAULT_STREAM_MODE_AUTO_UNI, then the incoming stream is rejected. bye 👋
  • Otherwise — meaning when the default stream mode is SSL_DEFAULT_STREAM_MODE_NONE — the application is assumed to be stream aware, and the incoming stream is accepted. we love a self-aware app 💅
• SSL_INCOMING_STREAM_POLICY_ACCEPT — always accept incoming streams, which lets them be dequeued using SSL_accept_stream(3). yes come in, sit down, stay a while 🫶
• SSL_INCOMING_STREAM_POLICY_REJECT — always reject incoming streams. not today 💀

Where an incoming stream is rejected, it's rejected immediately, and there is literally no way to gain access to that stream using SSL_accept_stream(3). It's gone, it's blocked, it's not on the list 😭. The stream gets rejected using QUIC STOP_SENDING and RESET_STREAM frames as appropriate.

---

🎀 RETURN VALUES 🎀

Returns 1 on success and 0 on failure. simple as that, no cap ✨

This function fails if you call it on a QUIC stream SSL object, or on a non-QUIC SSL object. wrong vibe check, wrong object, instant 0 🚫

---

🦋 SEE ALSO 🦋

SSL_set_default_stream_mode(3), SSL_accept_stream(3) — go read those next bestie, iykyk 📚

---

⭐ HISTORY ⭐

SSL_set_incoming_stream_policy() was added in OpenSSL 3.2. so she's relatively new but she's already iconic 💅

---

🌈 COPYRIGHT 🌈

Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

k that's the whole page bestie, go forth and configure your stream policy responsibly 🧚💜

version 3.5.6, dated 2026-04-07 — mwah, signed off with love 💖