IP Services: Understand change in VIPARANGE security verification processing

Description: Prior to z/OS V1R13, the System Authorization Facility (SAF) resource profile associated with the VIPARANGE statement (EZB.BINDDVIPARANGE.sysname.tcpname) was ignored in the following scenario when an application issues a bind:

• The port specified on the bind matches a PORT statement, and
• the IP address of the application's bind is within a VIPARANGE subnet, or the application's bind is an unspecified address and the IP address on the BIND parameter of the PORT statement is within a VIPARANGE subnet.

In this scenario, the PORT statement (including its optional SAF parameter) was used to control access to both the port and to creating the dynamic VIPA (DVIPA).

Beginning in V1R13, the VIPARANGE resource profile is not ignored in this scenario; creation of the IP address is controlled by both the SAF resource profile associated with the VIPARANGE statement and by the PORT statement:

• For a VIPARANGE statement, you can control the creation of the IP address by defining the following SAF resource profiles in the SERVAUTH class:
  • EZB.BINDDVIPARANGE.sysname.tcpname
  • EZB.BINDDVIPARANGE.sysname.tcpname.resname, if the new SAF parameter is included on the VIPARANGE statement
• The PORT statement controls whether an application can bind to a given port.

Steps to take: Be aware that the EZB.BINDDVIPARANGE.sysname.tcpname resource profile is always checked if defined; ensure all applications that create DVIPAs by binding to addresses within a VIPARANGE subnet have READ access to this resource.