get_ssa(
	Operation *op,
	BerElement	*ber,
	Filter 		*f,
	const char	**text )
{
	ber_tag_t	tag;
	ber_len_t	len;
	int	rc;
	struct berval desc, value, nvalue;
	char		*last;
	SubstringsAssertion ssa;

	*text = "error decoding filter";

	Debug( LDAP_DEBUG_FILTER, "begin get_ssa\n", 0, 0, 0 );
	if ( ber_scanf( ber, "{m" /*}*/, &desc ) == LBER_ERROR ) {
		return SLAPD_DISCONNECT;
	}

	*text = NULL;

	ssa.sa_desc = NULL;
	ssa.sa_initial.bv_val = NULL;
	ssa.sa_any = NULL;
	ssa.sa_final.bv_val = NULL;

	rc = slap_bv2ad( &desc, &ssa.sa_desc, text );

	if( rc != LDAP_SUCCESS ) {
		f->f_choice |= SLAPD_FILTER_UNDEFINED;
		rc = slap_bv2undef_ad( &desc, &ssa.sa_desc, text,
			SLAP_AD_PROXIED|SLAP_AD_NOINSERT );

		if( rc != LDAP_SUCCESS ) {
			Debug( LDAP_DEBUG_ANY, 
				"get_ssa: conn %lu unknown attribute type=%s (%ld)\n",
				op->o_connid, desc.bv_val, (long) rc );
	
			ssa.sa_desc = slap_bv2tmp_ad( &desc, op->o_tmpmemctx );
		}
	}

	rc = LDAP_PROTOCOL_ERROR;

	/* If there is no substring matching rule, there's nothing
	 * we can do with this filter. But we continue to parse it
	 * for logging purposes.
	 */
	if ( ssa.sa_desc->ad_type->sat_substr == NULL ) {
		f->f_choice |= SLAPD_FILTER_UNDEFINED;
		Debug( LDAP_DEBUG_FILTER,
		"get_ssa: no substring matching rule for attributeType %s\n",
			desc.bv_val, 0, 0 );
	}

	for ( tag = ber_first_element( ber, &len, &last );
		tag != LBER_DEFAULT;
		tag = ber_next_element( ber, &len, last ) )
	{
		unsigned usage;

		if ( ber_scanf( ber, "m", &value ) == LBER_ERROR ) {
			rc = SLAPD_DISCONNECT;
			goto return_error;
		}

		if ( value.bv_val == NULL || value.bv_len == 0 ) {
			rc = LDAP_INVALID_SYNTAX;
			goto return_error;
		} 

		switch ( tag ) {
		case LDAP_SUBSTRING_INITIAL:
			if ( ssa.sa_initial.bv_val != NULL
				|| ssa.sa_any != NULL 
				|| ssa.sa_final.bv_val != NULL )
			{
				rc = LDAP_PROTOCOL_ERROR;
				goto return_error;
			}
			usage = SLAP_MR_SUBSTR_INITIAL;
			break;

		case LDAP_SUBSTRING_ANY:
			if ( ssa.sa_final.bv_val != NULL ) {
				rc = LDAP_PROTOCOL_ERROR;
				goto return_error;
			}
			usage = SLAP_MR_SUBSTR_ANY;
			break;

		case LDAP_SUBSTRING_FINAL:
			if ( ssa.sa_final.bv_val != NULL ) {
				rc = LDAP_PROTOCOL_ERROR;
				goto return_error;
			}

			usage = SLAP_MR_SUBSTR_FINAL;
			break;

		default:
			Debug( LDAP_DEBUG_FILTER,
				"  unknown substring choice=%ld\n",
				(long) tag, 0, 0 );

			rc = LDAP_PROTOCOL_ERROR;
			goto return_error;
		}

		/* validate/normalize using equality matching rule validator! */
		rc = asserted_value_validate_normalize(
			ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
			usage, &value, &nvalue, text, op->o_tmpmemctx );
		if( rc != LDAP_SUCCESS ) {
			f->f_choice |= SLAPD_FILTER_UNDEFINED;
			Debug( LDAP_DEBUG_FILTER,
			"get_ssa: illegal value for attributeType %s (%d) %s\n",
				desc.bv_val, rc, *text );
			ber_dupbv_x( &nvalue, &value, op->o_tmpmemctx );
		}

		switch ( tag ) {
		case LDAP_SUBSTRING_INITIAL:
			Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
			ssa.sa_initial = nvalue;
			break;

		case LDAP_SUBSTRING_ANY:
			Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
			ber_bvarray_add_x( &ssa.sa_any, &nvalue, op->o_tmpmemctx );
			break;

		case LDAP_SUBSTRING_FINAL:
			Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
			ssa.sa_final = nvalue;
			break;

		default:
			assert( 0 );
			slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
			rc = LDAP_PROTOCOL_ERROR;

return_error:
			Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
				(long) rc, 0, 0 );
			slap_sl_free( ssa.sa_initial.bv_val, op->o_tmpmemctx );
			ber_bvarray_free_x( ssa.sa_any, op->o_tmpmemctx );
			if ( ssa.sa_desc->ad_flags & SLAP_DESC_TEMPORARY )
				op->o_tmpfree( ssa.sa_desc, op->o_tmpmemctx );
			slap_sl_free( ssa.sa_final.bv_val, op->o_tmpmemctx );
			return rc;
		}

		*text = NULL;
		rc = LDAP_SUCCESS;
	}

	if( rc == LDAP_SUCCESS ) {
		f->f_sub = op->o_tmpalloc( sizeof( ssa ), op->o_tmpmemctx );
		*f->f_sub = ssa;
	}

	Debug( LDAP_DEBUG_FILTER, "end get_ssa\n", 0, 0, 0 );
	return rc /* LDAP_SUCCESS */ ;
}