[fzipi]

Addresses the remaining items of owasp-modsecurity/ModSecurity#2860 (reported by @diablodale, originally from coreruleset/coreruleset#3080).

chain

• Rewrites the misleading bullet ("executed if the rule that contains them matches"). Chained rules are evaluated in order and evaluation stops at the first non-match, so a non-disruptive action runs once its rule and every rule before it matched.
• Keeps the v2/v3 distinction: in v2 this applies to every non-disruptive action, in v3 only to setvar.
• Adds a worked three-rule example (+1/+2/+4 ends at 3 when the last rule fails).
• Links to the update-action caveats.

SecRuleUpdateActionById: replaces the short note with an "Updating chained rules" subsection.

• v2: msre_actionset_merge always takes is_chained from the update, so an update without chain unchains the rule (the case-5 failure in coreruleset#3080). Repeat chain only on rules that already have it. RULEID:offset semantics are documented. Includes a wrong/right example.
• v3: updates are runtime overlays keyed by rule ID. Only the starter can be targeted, the chain can't be broken, and a repeated chain is ignored with a "General failure" message. Every updated action, setvar included, runs only on a full chain match.

How this was verified

• v3: ran a scratch regression file through test/regression_tests on current v3/master, covering a failing last rule, a failing starter, a 3-rule partial match, ctl in the starter, update with and without chain, and deny/setvar added by update. All the v3 statements match the measured results.
• v2: from source (apache2/re.c, apache2/apache2_config.c on v2/master) plus @diablodale's measured 2.9.3 repro in coreruleset#3080. Not re-run in v2 here. The "msg not logged" point is attributed as a report rather than stated as fact.

Refs owasp-modsecurity/ModSecurity#2860 (it won't auto-close across repos).

🤖 Generated with Claude Code