From 1f6eb9cdc34e496979c25223c32721fb9ad838b6 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 18 Apr 2024 13:50:37 -0400
Subject: [PATCH] match keys better. go through files reverse first found is
 prio

---
 salt/salt/engines/master/pillarWatch.py | 24 +++++++++++++++---------
 salt/salt/files/engines.conf            |  1 +
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/salt/salt/engines/master/pillarWatch.py b/salt/salt/engines/master/pillarWatch.py
index abbb632f8..9f85a07c4 100644
--- a/salt/salt/engines/master/pillarWatch.py
+++ b/salt/salt/engines/master/pillarWatch.py
@@ -26,8 +26,6 @@ def start(fpa, interval=10):
 
     df = dataFile.read()
     for i in fpa:
-        currentPillarValue = ''
-        previousPillarValue = ''
         log.trace("pillarWatch engine: files: %s" % i['files'])
         log.trace("pillarWatch engine: pillar: %s" % i['pillar'])
         log.trace("pillarWatch engine: actions: %s" % i['actions'])
@@ -36,9 +34,12 @@ def start(fpa, interval=10):
         actions = i['actions']
         # these are the keys that we are going to look for as we traverse the pillarFiles
         patterns = pillar.split(".")
-        # this var is used to track how many times the pattern has been found in the pillar file so that we can access the proper index later
-        patternFound = 0
-        for pillarFile in pillarFiles:
+        # check the pillar files in reveresed order to replicate the same hierarchy as the pillar top file
+        for pillarFile in reversed(pillarFiles):
+          currentPillarValue = ''
+          previousPillarValue = ''
+          # this var is used to track how many times the pattern has been found in the pillar file so that we can access the proper index later
+          patternFound = 0
           with open(pillarFile, "r") as file:
             log.info("pillarWatch engine: checking file: %s" % pillarFile)
             for line in file:
@@ -47,7 +48,7 @@ def start(fpa, interval=10):
                 # since we are looping line by line through a pillar file, the next line will check if each line matches the progression of keys through the pillar
                 # ex. if we are looking for the value of global.pipeline, then this will loop through the pillar file until 'global' is found, then it will look
                 # for pipeline. once pipeline is found, it will record the value
-                if re.search(patterns[patternFound] + ':', line):
+                if re.search('^' + patterns[patternFound] + ':', line.strip()):
                     # strip the newline because it makes the logs u-g-l-y
                     log.info("pillarWatch engine: found: %s" % line.strip('\n'))
                     patternFound += 1
@@ -70,8 +71,12 @@ def start(fpa, interval=10):
                         else:
                             df += pillar + ': ' + currentPillarValue + '\n'
                         log.trace("pillarWatch engine: df: %s" % df)
-                        # we have found the pillar so we dont need to loop throught the file anymore
+                        # we have found the pillar so we dont need to loop through the file anymore
                         break
+          # if key and value was found in the first file, then we don't want to look in
+          # any more files since we use the first file as the source of truth.
+          if patternFound == len(patterns):
+              break
         # if the pillar value changed, then we find what actions we should take
         log.info("pillarWatch engine: checking if currentPillarValue != previousPillarValue")
         log.info("pillarWatch engine: %s currentPillarValue: %s" % (pillar, currentPillarValue))
@@ -111,8 +116,9 @@ def start(fpa, interval=10):
                     for saltModule, args in action.items():
                         log.info("pillarWatch engine: saltModule: %s" % saltModule)
                         log.info("pillarWatch engine: args: %s" % args)
-                        actionReturn = __salt__[saltModule](**args)
-                        log.info("pillarWatch engine: actionReturn: %s" % actionReturn)
+                        __salt__[saltModule](**args)
+                        #actionReturn = __salt__[saltModule](**args)
+                        #log.info("pillarWatch engine: actionReturn: %s" % actionReturn)
 
     dataFile.seek(0)
     dataFile.write(df)
diff --git a/salt/salt/files/engines.conf b/salt/salt/files/engines.conf
index c15194eaf..3066f588c 100644
--- a/salt/salt/files/engines.conf
+++ b/salt/salt/files/engines.conf
@@ -6,6 +6,7 @@ engines:
       interval: 60
   - pillarWatch:
       fpa:
+        # these files will be checked in reversed order to replicate the same hierarchy as the pillar top file
         - files:
             - /opt/so/saltstack/local/pillar/global/soc_global.sls
             - /opt/so/saltstack/local/pillar/global/adv_global.sls