SSL_SET_INCOM...STREAM_POLICY(3SSL)

📦
version 4.0.3 · 6 versions
, in ubuntu stonking

💖 SSL_SET_INCOMING_STREAM_POLICY 💖

okay bestie, so this is a page from the OpenSSL manual, section 3SSL, and it's literally all about who gets to slide into your QUIC connection's DMs. pull up a chair. 🪑

✨ NAME ✨

SSL_set_incoming_stream_policy, SSL_INCOMING_STREAM_POLICY_AUTO, SSL_INCOMING_STREAM_POLICY_ACCEPT, SSL_INCOMING_STREAM_POLICY_REJECT — they manage the QUIC incoming stream policy, and by "manage" I mean they decide whether randos get to open streams on your connection or get politely (or not so politely) told to leave. 🚪

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

#define SSL_INCOMING_STREAM_POLICY_AUTO
#define SSL_INCOMING_STREAM_POLICY_ACCEPT
#define SSL_INCOMING_STREAM_POLICY_REJECT

int SSL_set_incoming_stream_policy(SSL *conn, int policy,
                                          uint64_t app_error_code);

like, that's the whole vibe. one function, three vibes to pick from. 💅

🦋 DESCRIPTION 🦋

SSL_set_incoming_stream_policy() changes the incoming stream policy for a QUIC connection. Depending on the policy you configure, OpenSSL QUIC may automatically reject incoming streams that the peer initiated. why tho? because we love our legacy apps and we want to protect them — the whole point is to make sure that legacy applications doing single-stream operation with a default stream on a QUIC connection SSL object don't get handed remotely-initiated streams by a peer, because those apps are not prepared to handle them. no cap. 🙈

app_error_code is an application error code, and it's the one that gets used in any QUIC STOP_SENDING or RESET_STREAM frames generated to implement the policy. The default application error code is 0. ⭐

so, the valid values for policy are:

  • SSL_INCOMING_STREAM_POLICY_AUTO — this is the default setting, bestie. Incoming streams get accepted according to these rules:
    • If the default stream mode (configured using SSL_set_default_stream_mode(3)) is set to SSL_DEFAULT_STREAM_MODE_AUTO_BIDI (the default) or SSL_DEFAULT_STREAM_MODE_AUTO_UNI, the incoming stream is rejected. sorry not sorry 💀
    • Otherwise (where the default stream mode is SSL_DEFAULT_STREAM_MODE_NONE), the application is assumed to be stream aware, and the incoming stream is accepted. ok queen, you know what you're doing 👑
  • SSL_INCOMING_STREAM_POLICY_ACCEPT — always accept incoming streams, allowing them to be dequeued using SSL_accept_stream(3). everybody's welcome, the more the merrier 🫶
  • SSL_INCOMING_STREAM_POLICY_REJECT — always reject incoming streams. door's closed. periodt. 🚫

Where an incoming stream is rejected, it is rejected immediately, and it is literally not possible to gain access to the stream using SSL_accept_stream(3). The stream gets rejected using QUIC STOP_SENDING and RESET_STREAM frames as appropriate. it's giving "blocked and reported" 📵

🌈 RETURN VALUES 🌈

Returns 1 on success and 0 on failure. iconic one-or-zero behaviour, no in between. ✨

This function fails if called on a QUIC stream SSL object, or on a non-QUIC SSL object. so like... read the room before you call it. 😭

💜 SEE ALSO 💜

go read those too, iykyk. 📚

🎀 HISTORY 🎀

SSL_set_incoming_stream_policy() was added in OpenSSL 3.2. so it's a newer bestie, not an ancient one. 🧚

Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page angel 💖 this was OpenSSL 4.0.3, dated 2026-09-2 — go slay some QUIC streams, but like, responsibly. 🌸✨🦋

📦 where this page comes from