fix(attestation): reject other non-current TCB statuses

Author: kvinwang

docs/security/security-model.md

@@ -297,9 +297,9 @@ risk is already outside dstack's confidentiality/integrity guarantees.
 
 ### Out-of-date TCBs have a bounded grace period
 
-dstack applies `dcap-qvl`'s quote policy after cryptographic verification. Platform and quoting-enclave TCB levels reported as `OutOfDate` are accepted for 15 days after the corresponding TCB level's publication date. Once that grace period expires, verification fails. `Revoked` TCBs are always rejected.
+dstack applies `dcap-qvl`'s quote policy after cryptographic verification. `UpToDate` is accepted, while platform and quoting-enclave TCB levels reported as `OutOfDate` are accepted for 15 days after the corresponding TCB level's publication date. Once that grace period expires, verification fails. All other TCB statuses, including `ConfigurationNeeded`, `SWHardeningNeeded`, and `Revoked`, are rejected.
 
-Other non-current statuses (`ConfigurationNeeded`, `SWHardeningNeeded`, and their combinations) remain accepted and are surfaced in the verified report for downstream policy decisions. `validate_tcb` separately enforces hard invariants: debug mode must be off, and the SEAM/service-TD measurements must be well-formed.
+`validate_tcb` separately enforces hard invariants: debug mode must be off, and the SEAM/service-TD measurements must be well-formed.
 
 ### Development modes are auditable, not production-safe
 

dstack/dstack-attest/src/attestation.rs

@@ -210,11 +210,7 @@ const TCB_OUT_OF_DATE_GRACE_PERIOD: Duration = Duration::from_secs(15 * 24 * 60
 
 fn tdx_quote_policy(now: u64) -> QuotePolicy {
     QuotePolicy::strict(now)
-        .allow_status(TcbStatus::SWHardeningNeeded)
-        .allow_status(TcbStatus::ConfigurationNeeded)
-        .allow_status(TcbStatus::ConfigurationAndSWHardeningNeeded)
         .allow_status(TcbStatus::OutOfDate)
-        .allow_status(TcbStatus::OutOfDateConfigurationNeeded)
         .platform_grace_period(TCB_OUT_OF_DATE_GRACE_PERIOD)
         .qe_grace_period(TCB_OUT_OF_DATE_GRACE_PERIOD)
         .allow_dynamic_platform(true)
@@ -2515,6 +2511,22 @@ pub struct AppInfo {
 mod tests {
     use super::*;
 
+    #[test]
+    fn tdx_policy_accepts_only_up_to_date_and_out_of_date() {
+        let policy = tdx_quote_policy(0);
+        assert!(policy.is_status_acceptable(TcbStatus::UpToDate));
+        assert!(policy.is_status_acceptable(TcbStatus::OutOfDate));
+        for status in [
+            TcbStatus::OutOfDateConfigurationNeeded,
+            TcbStatus::ConfigurationAndSWHardeningNeeded,
+            TcbStatus::ConfigurationNeeded,
+            TcbStatus::SWHardeningNeeded,
+            TcbStatus::Revoked,
+        ] {
+            assert!(!policy.is_status_acceptable(status));
+        }
+    }
+
     #[test]
     fn external_trust_anchor_requires_explicit_insecure_opt_in() {
         let config = AttestationVerifierConfig {

dstack/local-key-provider/src/provider.rs

@@ -124,11 +124,7 @@ const TCB_OUT_OF_DATE_GRACE_PERIOD: Duration = Duration::from_secs(15 * 24 * 60
 
 fn tdx_quote_policy(now: u64) -> QuotePolicy {
     QuotePolicy::strict(now)
-        .allow_status(TcbStatus::SWHardeningNeeded)
-        .allow_status(TcbStatus::ConfigurationNeeded)
-        .allow_status(TcbStatus::ConfigurationAndSWHardeningNeeded)
         .allow_status(TcbStatus::OutOfDate)
-        .allow_status(TcbStatus::OutOfDateConfigurationNeeded)
         .platform_grace_period(TCB_OUT_OF_DATE_GRACE_PERIOD)
         .qe_grace_period(TCB_OUT_OF_DATE_GRACE_PERIOD)
         .allow_dynamic_platform(true)
@@ -140,6 +136,22 @@ fn tdx_quote_policy(now: u64) -> QuotePolicy {
 mod tests {
     use super::*;
 
+    #[test]
+    fn tdx_policy_accepts_only_up_to_date_and_out_of_date() {
+        let policy = tdx_quote_policy(0);
+        assert!(policy.is_status_acceptable(TcbStatus::UpToDate));
+        assert!(policy.is_status_acceptable(TcbStatus::OutOfDate));
+        for status in [
+            TcbStatus::OutOfDateConfigurationNeeded,
+            TcbStatus::ConfigurationAndSWHardeningNeeded,
+            TcbStatus::ConfigurationNeeded,
+            TcbStatus::SWHardeningNeeded,
+            TcbStatus::Revoked,
+        ] {
+            assert!(!policy.is_status_acceptable(status));
+        }
+    }
+
     #[test]
     fn extracts_all_key_derivation_measurements_in_wire_order() {
         let quote = Quote::parse(include_bytes!("../../ra-tls/assets/tdx_quote")).unwrap();