Control Over TCP Listeners Binding to Port 0

Description:
Our organization enforces strict controls over all TCP listeners on our stack using the UNRSV TCP DENY WHEN LISTEN logic and SAF resource keyword definitions. This approach ensures that only authorized listeners, explicitly defined in our Port statement, are permitted to start.

However, we have identified a significant gap: applications can bypass these controls by binding to port 0. In this scenario, the TCP/IP stack assigns a random ephemeral port that is not registered in our Port statement. This behavior prevents us from:

• Enforcing listener controls,
• Creating effective filter rules,
• Auditing and monitoring listener activity,
• Maintaining compliance with internal and regulatory requirements.

Business Impact:

• Security Risk: Uncontrolled listeners may be created, exposing the environment to unauthorized access or data exfiltration.
• Compliance Risk: Inability to audit or control all network listeners may violate regulatory or internal policy requirements.
• Operational Risk: Filter rules and monitoring cannot be reliably applied, increasing the risk of undetected or unauthorized network activity.

We would like IBM to build a solution that closes this allowing us to control this behavior and be able to assign SAF controls through the EZB.PORTACCESS like we do for other ports