BIO_S_ACCEPT(3ossl)

✨ NAME ✨

okay so this whole page is about the accept BIO family, aka OpenSSL's 3ossl manual page BIO_S_ACCEPT(3ossl) — and it covers literally all of these besties:

BIO_s_accept, BIO_set_accept_name, BIO_set_accept_port, BIO_get_accept_name, BIO_get_accept_port, BIO_new_accept, BIO_set_nbio_accept, BIO_set_tfo_accept, BIO_set_accept_bios, BIO_get_peer_name, BIO_get_peer_port, BIO_get_accept_ip_family, BIO_set_accept_ip_family, BIO_set_bind_mode, BIO_get_bind_mode, BIO_do_accept

---

💅 SYNOPSIS 💅

#include <openssl/bio.h>

const BIO_METHOD *BIO_s_accept(void);

long BIO_set_accept_name(BIO *b, char *name);
char *BIO_get_accept_name(BIO *b);

long BIO_set_accept_port(BIO *b, char *port);
char *BIO_get_accept_port(BIO *b);

BIO *BIO_new_accept(char *host_port);

long BIO_set_nbio_accept(BIO *b, int n);
long BIO_set_tfo_accept(BIO *b, int n);
long BIO_set_accept_bios(BIO *b, char *bio);

char *BIO_get_peer_name(BIO *b);
char *BIO_get_peer_port(BIO *b);
long BIO_get_accept_ip_family(BIO *b);
long BIO_set_accept_ip_family(BIO *b, long family);

long BIO_set_bind_mode(BIO *b, long mode);
long BIO_get_bind_mode(BIO *b);

int BIO_do_accept(BIO *b);

---

🦋 DESCRIPTION 🦋

BIO_s_accept() hands you the accept BIO method, and lowkey it's just a cute little wrapper around your platform's TCP/IP socket accept routines. that's the whole vibe.

so with accept BIOs you can accept TCP/IP connections and move data around using nothing but BIO routines — meaning all the messy platform-specific stuff stays hidden behind the BIO abstraction. slay for portability honestly. ✨

read and write ops on an accept BIO just do I/O on the underlying connection. and if there's no connection yet but the port (more on that below 💖) is set up properly, the BIO just sits there waiting for someone to show up. main character energy: it waits.

accept BIOs support BIO_puts() but not BIO_gets().

if the close flag is set on an accept BIO, then any active connection on that chain gets shut down and the socket gets closed when the BIO is freed. bye bestie 👋

calling BIO_reset() on an accept BIO closes any active connection and resets the BIO right back into its "waiting for another incoming connection" era.

BIO_get_fd() and BIO_set_fd() can be called to retrieve or set the accept socket — peep BIO_s_fd(3) for that one.

BIO_set_accept_name() uses the string name to set the accept name. the name is a string shaped like "host:port", where "host" is the interface to use and "port" is the port. the host can be "*" or empty, and both mean any interface. if the host is an IPv6 address it has to be wrapped in brackets, like "[::1]:https". and "port" has the same syntax as the port you'd give BIO_set_conn_port() for connect BIOs — so it can be a numerical port string, or a string to look up using getservbyname() and a string table.

BIO_set_accept_port() uses the string port to set the accept port of BIO b. same deal: "port" matches the syntax of the port in BIO_set_conn_port() for connect BIOs, so either a numerical port string or a string looked up with getservbyname() and a string table. and if the given port is 0, a random available port gets chosen — you can query it with BIO_sock_info() and BIO_ADDR_service_string(3). cute right 🎀

BIO_new_accept() is basically BIO_new() plus BIO_set_accept_name() in one call: it creates a new accept BIO with port host_port.

BIO_set_nbio_accept() sets the accept socket to blocking mode (that's the default) if n is 0, or non-blocking mode if n is 1.

BIO_set_tfo_accept() turns on TCP Fast Open on the accept socket if n is 1, or turns it off if n is 0 (the default). setting it to 1 is equivalent to setting BIO_SOCK_TFO in BIO_set_bind_mode(). 🔥

BIO_set_accept_bios() lets you set a chain of BIOs that will get duplicated and prepended to the chain whenever an incoming connection arrives. super useful if, say, you need a buffering or SSL BIO for every single connection.

⚠️ the chain of BIOs must not be freed after this call, bestie — they get automatically freed when the accept BIO is freed. don't do it, i'm begging 😭

BIO_get_accept_ip_family() returns the IP family accepted by BIO b, which may be BIO_FAMILY_IPV4, BIO_FAMILY_IPV6, or BIO_FAMILY_IPANY.

BIO_set_accept_ip_family() sets the IP family family accepted by BIO b. the default is BIO_FAMILY_IPANY.

BIO_set_bind_mode() and BIO_get_bind_mode() set and retrieve the current bind mode:

• if BIO_BIND_NORMAL (the default) is set, then another socket cannot bind to the same port.
• if BIO_BIND_REUSEADDR is set, then other sockets can bind to the same port.
• if BIO_BIND_REUSEADDR_IF_UNUSED is set, then an attempt is first made to use BIO_BIN_NORMAL, and if that fails and the port isn't in use, a second attempt is made using BIO_BIND_REUSEADDR.
• if BIO_SOCK_TFO is set, then the socket will be configured to accept TCP Fast Open connections. ✨

BIO_do_accept() is doing double duty, iconic honestly. when it's called the first time, after the accept BIO has been set up, it tries to create the accept socket and bind an address to it. second and subsequent calls to BIO_do_accept() await an incoming connection, or request a retry in non-blocking mode.

---

🌸 NOTES 🌸

when an accept BIO is at the end of a chain, it awaits an incoming connection before processing I/O calls. when an accept BIO is not at the end of a chain, it passes I/O calls along to the next BIO in the chain. teamwork 💖

when a connection gets established, a new socket BIO is created for that connection and appended to the chain — so the chain becomes accept->socket. which effectively means that attempting I/O on an initial accept socket will await an incoming connection and then do I/O on it. sneaky but make it functional.

if any extra BIOs were set with BIO_set_accept_bios(), they get placed between the socket and the accept BIO, so the chain looks like accept->otherbios->socket.

if a server wants to process multiple connections (which, fr fr, is normally the case), then the accept BIO has to be made available for further incoming connections. you do that by waiting for a connection and then calling:

connection = BIO_pop(accept);

after this call, connection holds a BIO for the recently established connection, and accept is now a single BIO again, ready to await more incoming connections. if no further connections will be accepted, you can free the accept with BIO_free().

if you're only processing a single connection, you can do I/O using the accept BIO itself. but that's often undesirable, because the accept BIO will still be out here accepting additional incoming connections. 🙈 fix it by using BIO_pop() (see above) and freeing the accept BIO after that initial connection.

💀 if the underlying accept socket is non-blocking and BIO_do_accept() is called to await an incoming connection, it's possible to get BIO_should_io_special() with the reason BIO_RR_ACCEPT. if that happens it means an accept attempt would block — your app should take appropriate action to wait until the underlying socket has accepted a connection, then retry the call.

and just so you know, all of these are macros: BIO_set_accept_name(), BIO_get_accept_name(), BIO_set_accept_port(), BIO_get_accept_port(), BIO_set_nbio_accept(), BIO_set_accept_bios(), BIO_get_peer_name(), BIO_get_peer_port(), BIO_get_accept_ip_family(), BIO_set_accept_ip_family(), BIO_set_bind_mode(), BIO_get_bind_mode() and BIO_do_accept().

---

⭐ RETURN VALUES ⭐

BIO_do_accept(), BIO_set_accept_name(), BIO_set_accept_port(), BIO_set_nbio_accept(), BIO_set_accept_bios(), BIO_set_accept_ip_family(), and BIO_set_bind_mode() return 1 for success and <= 0 for failure.

BIO_get_accept_name() returns the accept name or NULL on error. BIO_get_peer_name() returns the peer name or NULL on error.

BIO_get_accept_port() returns the accept port as a string or NULL on error. BIO_get_peer_port() returns the peer port as a string or NULL on error. BIO_get_accept_ip_family() returns the IP family or <= 0 on error.

BIO_get_bind_mode() returns the set of BIO_BIND flags, or <= 0 on failure.

BIO_new_accept() returns a BIO or NULL on error.

---

🎀 EXAMPLES 🎀

this example accepts two connections on port 4444, sends messages down each, and finally closes both down. periodt.

BIO *abio, *cbio, *cbio2;

/* First call to BIO_do_accept() sets up accept BIO */
abio = BIO_new_accept("4444");
if (BIO_do_accept(abio) <= 0) {
    fprintf(stderr, "Error setting up accept\n");
    ERR_print_errors_fp(stderr);
    exit(1);
}

/* Wait for incoming connection */
if (BIO_do_accept(abio) <= 0) {
    fprintf(stderr, "Error accepting connection\n");
    ERR_print_errors_fp(stderr);
    exit(1);
}
fprintf(stderr, "Connection 1 established\n");

/* Retrieve BIO for connection */
cbio = BIO_pop(abio);
BIO_puts(cbio, "Connection 1: Sending out Data on initial connection\n");
fprintf(stderr, "Sent out data on connection 1\n");

/* Wait for another connection */
if (BIO_do_accept(abio) <= 0) {
    fprintf(stderr, "Error accepting connection\n");
    ERR_print_errors_fp(stderr);
    exit(1);
}
fprintf(stderr, "Connection 2 established\n");

/* Close accept BIO to refuse further connections */
cbio2 = BIO_pop(abio);
BIO_free(abio);
BIO_puts(cbio2, "Connection 2: Sending out Data on second\n");
fprintf(stderr, "Sent out data on connection 2\n");

BIO_puts(cbio, "Connection 1: Second connection established\n");

/* Close the two established connections */
BIO_free(cbio);
BIO_free(cbio2);

---

🧚 HISTORY 🧚

BIO_set_tfo_accept() was added in OpenSSL 3.2. she's new here, be nice 💅

---

👑 COPYRIGHT 👑

Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

aaand that's the whole page bestie 🫶 this was OpenSSL 3.5.0, dated 2026-09-25, page BIO_S_ACCEPT(3ossl) — go accept some connections, you're gonna ate 💖✨🌈