Clarify and fix coding style
NSString *domainConfigKey = getPinningConfigurationKeyForDomain(serverHostname, trustKitConfig);
if (domainConfigKey == nil)
{
- // The domain is not pinned: nothing to do/validate
+ // The domain has no pinning policy: nothing to do/validate
finalTrustDecision = TSKTrustDecisionDomainNotPinned;
}
else
{
- // This domain is pinned
+ // This domain has a pinning policy
NSDictionary *domainConfig = trustKitConfig[kTSKPinnedDomains][domainConfigKey];
// Has the pinning policy expired?
finalTrustDecision = TSKTrustDecisionDomainNotPinned;
}
- //Should exclude subdomain
- else if (domainConfig[kTSKExcludeSubdomainFromParentPolicy]){
- //yes should exclude
+ else if (domainConfig[kTSKExcludeSubdomainFromParentPolicy])
+ {
+ // This is a subdomain that was explicitely excluded from the parent domain's policy
finalTrustDecision = TSKTrustDecisionDomainNotPinned;
}
else
{
- // The pinning policy has not expired
+ // The domain has a pinning policy that has not expired
// Look for one the configured public key pins in the server's evaluated certificate chain
TSKPinValidationResult validationResult = verifyPublicKeyPin(serverTrust, serverHostname, domainConfig[kTSKPublicKeyAlgorithms], domainConfig[kTSKPublicKeyHashes]);
if (validationResult == TSKPinValidationResultSuccess)
