SSL_SET_INCO...TREAM_POLICY(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 SSL_SET_INCOMING_STREAM_POLICY 💖

okay bestie, gather round, because we're talking about SSL_set_incoming_stream_policy, SSL_INCOMING_STREAM_POLICY_AUTO, SSL_INCOMING_STREAM_POLICY_ACCEPT and SSL_INCOMING_STREAM_POLICY_REJECT — aka the whole little squad that manages the QUIC incoming stream policy. this is OpenSSL, section 3ossl, and she's a baddie. 💅

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

#define SSL_INCOMING_STREAM_POLICY_AUTO
#define SSL_INCOMING_STREAM_POLICY_ACCEPT
#define SSL_INCOMING_STREAM_POLICY_REJECT

int SSL_set_incoming_stream_policy(SSL *conn, int policy,
                                          uint64_t app_error_code);

🌸 DESCRIPTION 🌸

so SSL_set_incoming_stream_policy() does a little policy change — it swaps out the incoming stream policy for a QUIC connection. and depending on which policy you picked, OpenSSL QUIC may just automatically reject incoming streams that the peer started. no cap.

why tho? because the girlies (legacy applications) doing single-stream operation with a default stream on a QUIC connection SSL object were getting handed remotely-initiated streams by peers, and those apps were not prepared to handle them. so this exists to protect them. it's giving protective bestie energy. 🫶

app_error_code is an application error code, and it gets used in any QUIC STOP_SENDING or RESET_STREAM frames that get generated to actually implement the policy. the default application error code is 0.

now, the valid values for policy are, and I need you to pay attention bestie:

  • SSL_INCOMING_STREAM_POLICY_AUTO — this is the default setting. incoming streams get accepted according to these rules:
    • if the default stream mode (configured using SSL_set_default_stream_mode(3)) is set to SSL_DEFAULT_STREAM_MODE_AUTO_BIDI (which is the default) or SSL_DEFAULT_STREAM_MODE_AUTO_UNI, then the incoming stream is rejected. 💀
    • otherwise (when the default stream mode is SSL_DEFAULT_STREAM_MODE_NONE), the application is assumed to be stream aware, and the incoming stream is accepted. slay.
  • SSL_INCOMING_STREAM_POLICY_ACCEPT — always accept incoming streams, which lets them be dequeued using SSL_accept_stream(3). 😌
  • SSL_INCOMING_STREAM_POLICY_REJECT — always reject incoming streams. no thoughts, head empty, rejected.

and when an incoming stream does get rejected? it's rejected immediately, and it is not possible to gain access to that stream using SSL_accept_stream(3). it's gone, bestie. the stream is rejected using QUIC STOP_SENDING and RESET_STREAM frames as appropriate.

🦋 RETURN VALUES 🦋

  • returns 1 on success, 0 on failure.

and heads up: this function fails if you call it on a QUIC stream SSL object, or on a non-QUIC SSL object. so don't do that. 🙈

👑 SEE ALSO 👑

⭐ HISTORY ⭐

SSL_set_incoming_stream_policy() was added in OpenSSL 3.2. a relatively recent icon, honestly.

Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you ate it, I'm so proud of you. 🌈 this was OpenSSL 3.5.9, dated 2026-09-29 — mwah, mwah, periodt. 💖✨🎀🦋

📦 where this page comes from