SSL_SET_INCO...TREAM_POLICY(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 SSL_set_incoming_stream_policy(3ossl) — the OpenSSL bestie guide 🦋

okay so this is an OpenSSL manual page, and it's all about the QUIC incoming stream policy — literally the bouncer at the club door of your connection, deciding which peer-initiated streams get in and which get told to go home 💀

The star functions/constants are SSL_set_incoming_stream_policy, SSL_INCOMING_STREAM_POLICY_AUTO, SSL_INCOMING_STREAM_POLICY_ACCEPT, and SSL_INCOMING_STREAM_POLICY_REJECT — together they manage the QUIC incoming stream policy. iconic behavior ngl.

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

#define SSL_INCOMING_STREAM_POLICY_AUTO
#define SSL_INCOMING_STREAM_POLICY_ACCEPT
#define SSL_INCOMING_STREAM_POLICY_REJECT

int SSL_set_incoming_stream_policy(SSL *conn, int policy,
                                          uint64_t app_error_code);

🌸 DESCRIPTION 🌸

so SSL_set_incoming_stream_policy() changes the incoming stream policy for a QUIC connection. like it literally reassigns who's allowed in 💅

Depending on which policy you've configured, OpenSSL QUIC may automatically reject incoming streams that the peer initiated. Why do we care?? because this is intended to make sure that legacy applications doing single-stream operation with a default stream on a QUIC connection SSL object don't get handed remotely-initiated streams by a peer — streams those apps are simply not prepared to handle 😭 main character apps deserve main character protection.

app_error_code is an application error code, and it gets used in any QUIC STOP_SENDING or RESET_STREAM frames that get generated to implement the policy. The default application error code is 0 🎀

The valid values for policy are, in order:

  • SSL_INCOMING_STREAM_POLICY_AUTO — this is the default setting, bestie. Incoming streams are accepted according to these rules:
    • If the default stream mode (which you configure using SSL_set_default_stream_mode(3)) is set to SSL_DEFAULT_STREAM_MODE_AUTO_BIDI (that's the default) or SSL_DEFAULT_STREAM_MODE_AUTO_UNI, the incoming stream is rejected 🙈
    • Otherwise — meaning the default stream mode is SSL_DEFAULT_STREAM_MODE_NONE — the application is assumed to be stream aware, and the incoming stream is accepted ✨
  • SSL_INCOMING_STREAM_POLICY_ACCEPT — always accept incoming streams, allowing them to be dequeued using SSL_accept_stream(3). everyone's welcome, come on in 🫶
  • SSL_INCOMING_STREAM_POLICY_REJECT — always reject incoming streams. no cap, nobody gets in 💀

Where an incoming stream is rejected, it's rejected immediately, and there's literally no way to gain access to that stream using SSL_accept_stream(3) — it's gone, it's not coming back. The stream gets rejected using QUIC STOP_SENDING and RESET_STREAM frames, as appropriate 🔥

👑 RETURN VALUES 👑

Returns 1 on success and 0 on failure. slay.

This function fails if you call it on a QUIC stream SSL object, or on a non-QUIC SSL object. so like… read the room, wrong object type 🫠

🌈 SEE ALSO 🌈

⭐ HISTORY ⭐

SSL_set_incoming_stream_policy() was added in OpenSSL 3.2. a relatively recent queen 👑

Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie — no notes, ate and left no crumbs 🧚 this cutie was brought to you by version 3.5.0, dated 2026-09-25, and it's an OpenSSL manual page through and through 💜🦋

📦 where this page comes from