Adding upstream version 2:4.17.12+dfsg.upstream/2%4.17.12+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

53 files changed, 545 insertions, 0 deletions

diff --git a/selftest/knownfail.d/README b/selftest/knownfail.d/README
new file mode 100644
index 0000000..6f0262a
--- /dev/null
+++ b/selftest/knownfail.d/README
@@ -0,0 +1,8 @@
+# Files in this directory contain lists of regular expressions
+# matching the names of tests that are temporarily expected to fail.
+#
+# "make test" will not report failures for tests listed here and will consider
+# a successful run for any of these tests an error.
+#
+# Empty lines and lines beginning with '#' are ignored.
+# Please don't add tests to this README!
diff --git a/selftest/knownfail.d/bug-14236 b/selftest/knownfail.d/bug-14236
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/selftest/knownfail.d/bug-14236
diff --git a/selftest/knownfail.d/complex_expressions b/selftest/knownfail.d/complex_expressions
new file mode 100644
index 0000000..8ec468a
--- /dev/null
+++ b/selftest/knownfail.d/complex_expressions
@@ -0,0 +1,4 @@
+# Ldb accepts invalid search expressions and returns weird results.
+.*samba.tests.complex_expressions.ComplexExpressionTests.test_largeint_invalid_expressions.*
+.*samba.tests.complex_expressions.ComplexExpressionTests.test_enum_invalid_expressions.*
+.*samba.tests.complex_expressions.ComplexExpressionTests.test_invalid_expressions.*
diff --git a/selftest/knownfail.d/dirsync b/selftest/knownfail.d/dirsync
new file mode 100644
index 0000000..fcf4d46
--- /dev/null
+++ b/selftest/knownfail.d/dirsync
@@ -0,0 +1,13 @@
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_OBJECT_SECURITY_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_unicodePwd_OBJ_SEC_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_unicodePwd_with_GET_CHANGES_OBJ_SEC_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_unicodePwd_with_GET_CHANGES_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_with_GET_CHANGES_OBJECT_SECURITY_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_with_GET_CHANGES\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialFilteredDirsyncTests.test_dirsync_OBJECT_SECURITY_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialFilteredDirsyncTests.test_dirsync_OBJECT_SECURITY_with_GET_CHANGES_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialFilteredDirsyncTests.test_dirsync_with_GET_CHANGES_attr\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialFilteredDirsyncTests.test_dirsync_with_GET_CHANGES_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.FilteredDirsyncTests.test_dirsync_with_GET_CHANGES\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.FilteredDirsyncTests.test_dirsync_with_GET_CHANGES_attr\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.FilteredDirsyncTests.test_dirsync_with_GET_CHANGES_insist_on_empty_element\(.*\)
diff --git a/selftest/knownfail.d/dns b/selftest/knownfail.d/dns
new file mode 100644
index 0000000..fee2f2a
--- /dev/null
+++ b/selftest/knownfail.d/dns
@@ -0,0 +1,89 @@
+# These tests are expected to fail because we want to ensure that
+# unauthenicated updates are not permitted against the default
+# configuration, nor against an RODC
+
+samba.tests.dns.__main__.TestDNSUpdates.test_delete_record\(rodc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_readd_record\(rodc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_update_add_mx_record\(rodc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_update_add_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_empty_txt_records\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_hex_char_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_char_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_padded_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_slash_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_two_txt_records\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_rpc_self_referencing_cname\(rodc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_delete_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_readd_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_update_add_mx_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_update_add_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_empty_txt_records\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_hex_char_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_char_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_padded_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_slash_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_two_txt_records\(vampire_dc:local\)
+samba.tests.dns.__main__.TestComplexQueries.test_cname_two_chain\(rodc:local\)
+samba.tests.dns.__main__.TestComplexQueries.test_one_a_query\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_empty_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_hex_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_char_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_padding_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_slash_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_two_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_txt_rpc_to_dns\(rodc:local\)
+
+samba.tests.dns.__main__.TestZones.test_set_aging_disabled\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_set_aging_disabled\(vampire_dc:local\)
+
+samba.tests.dns.__main__.TestZones.test_soa_query\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_set_aging\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_update\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_update_disabled\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_refresh\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_rpc_add_no_timestamp\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_basic_scavenging\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_dns_tombstone_custom_match_rule\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_dns_tombstone_custom_match_rule_no_records\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_dns_tombstone_custom_match_rule_fail\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_dynamic_record_static_update\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_static_record_dynamic_update\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_fully_qualified_zone\(rodc:local\)
+
+samba.tests.dns.__main__.TestZones.test_set_aging\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_update\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_update_disabled\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_refresh\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_basic_scavenging\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_dns_tombstone_custom_match_rule\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_dynamic_record_static_update\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_static_record_dynamic_update\(vampire_dc:local\)
+
+samba.tests.dns.__main__.TestComplexQueries.test_cname_two_chain\(vampire_dc:local\)
+samba.tests.dns.__main__.TestComplexQueries.test_one_a_query\(vampire_dc:local\)
+
+# The SOA override should not pass against the RODC, it must not overstamp
+samba.tests.dns.__main__.TestSimpleQueries.test_one_SOA_query\(rodc:local\)
+
+#
+# rodc and vampire_dc require signed dns updates, so these tests' setups
+# fail, but they pass on fl2003dc
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_loop\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_loop\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_A\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_A\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_AAAA\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_AAAA\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_SRV\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_SRV\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_limit\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_limit\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_any_query\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_any_query\(rodc:local\)
+
+# Tests for the dnsProperty parse issue do not pass here, but do against fl2003dc
+^samba.tests.dns.__main__.TestZones.test_enum_zones_while_dnsProperty_zero_length\(rodc:local\)
+^samba.tests.dns.__main__.TestZones.test_rpc_zone_update_while_dnsProperty_zero_length\(rodc:local\)
+^samba.tests.dns.__main__.TestZones.test_rpc_zone_update_while_other_dnsProperty_zero_length\(rodc:local\)
+^samba.tests.dns.__main__.TestZones.test_update_while_dnsProperty_zero_length\(rodc:local\)
+^samba.tests.dns.__main__.TestZones.test_update_while_dnsProperty_zero_length\(vampire_dc:local\)
\ No newline at end of file
diff --git a/selftest/knownfail.d/dns-aging b/selftest/knownfail.d/dns-aging
new file mode 100644
index 0000000..dd6998d
--- /dev/null
+++ b/selftest/knownfail.d/dns-aging
@@ -0,0 +1,78 @@
+# known failures for python/samba/tests/dns_aging.py
+#
+# These all pass on Windows, apart from test_basic_scavenging, which
+# fails due to technical issues.
+
+samba.tests.dns_aging.__main__.TestDNSAging.test_aging_refresh
+samba.tests.dns_aging.+test_dns_add_sibling_0_0_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_0_0_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_0_0_days_no_aging
+samba.tests.dns_aging.+test_dns_add_sibling_0_0_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_0_7_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_0_7_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_0_7_days_no_aging
+samba.tests.dns_aging.+test_dns_add_sibling_0_7_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_10_0_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_10_0_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_10_0_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_112_7_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_112_7_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_112_7_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_113_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_12_113_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_113_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_3_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_12_3_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_3_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_7_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_12_7_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_7_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_2_7_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_2_7_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_2_7_days_no_aging_touch
+samba.tests.dns_aging.+test_add_update_dwSerial
+samba.tests.dns_aging.+test_add_update_dwSerial_2
+samba.tests.dns_aging.+test_add_update_many
+samba.tests.dns_aging.+test_add_update_ttl_serial
+samba.tests.dns_aging.+test_dns_delete_simple_0_0_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_0_113_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_10_0_days_aging
+samba.tests.dns_aging.+test_dns_delete_simple_10_0_days_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_10_0_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_112_113_days_aging
+samba.tests.dns_aging.+test_dns_delete_simple_112_113_days_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_112_113_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_12_13_days_aging
+samba.tests.dns_aging.+test_dns_delete_simple_12_13_days_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_12_13_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_2_13_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_2_3_days_no_aging_touch
+samba.tests.dns_aging.+test_dynamic_record_static_update
+samba.tests.dns_aging.+test_multi_records_delete_aging
+samba.tests.dns_aging.+test_static_record_dynamic_update
+samba.tests.dns_aging.+test_update_aging_disabled\b
+samba.tests.dns_aging.+test_update_aging_disabled_beyond_refresh_window
+samba.tests.dns_aging.+test_update_aging_disabled_in_eighteenth_century
+samba.tests.dns_aging.+test_update_aging_disabled_in_no_refresh_window
+samba.tests.dns_aging.+test_update_aging_disabled_in_refresh_window
+samba.tests.dns_aging.+test_update_aging_disabled_on_no_refresh_boundary
+samba.tests.dns_aging.+test_update_aging_disabled_static
+samba.tests.dns_aging.+test_update_aging_enabled
+samba.tests.dns_aging.+test_update_aging_enabled_beyond_refresh_window
+samba.tests.dns_aging.+test_update_aging_enabled_in_eighteenth_century
+samba.tests.dns_aging.+test_update_aging_enabled_in_no_refresh_window
+samba.tests.dns_aging.+test_update_aging_enabled_in_refresh_window
+samba.tests.dns_aging.+test_update_aging_enabled_on_no_refresh_boundary
+samba.tests.dns_aging.+test_update_static_stickiness
+samba.tests.dns_aging.+test_update_timestamp_weirdness_no_refresh_no_aging
+samba.tests.dns_aging.+test_update_timestamp_weirdness_refresh_no_aging
+samba.tests.dns_aging.+test_AAAA_5_days_AAAA_6_days_aging
+samba.tests.dns_aging.+test_A_10_days_AAAA_5_days_aging
+samba.tests.dns_aging.+test_A_10_days_AAAA_5_days_no_aging
+samba.tests.dns_aging.+test_A_10_days_AAAA_9_days_aging
+samba.tests.dns_aging.+test_A_20_days_AAAA_2_days_aging
+samba.tests.dns_aging.+test_A_5_days_AAAA_10_days_aging
+samba.tests.dns_aging.+test_A_5_days_AAAA_5_days_aging
+samba.tests.dns_aging.+test_A_5_days_A_5_days_aging
+samba.tests.dns_aging.+test_A_9_days_AAAA_10_days_no_aging
+samba.tests.dns_aging.+test_samba_scavenging
diff --git a/selftest/knownfail.d/dns_packet b/selftest/knownfail.d/dns_packet
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/selftest/knownfail.d/dns_packet
diff --git a/selftest/knownfail.d/durable-v2-delay b/selftest/knownfail.d/durable-v2-delay
new file mode 100644
index 0000000..2a84749
--- /dev/null
+++ b/selftest/knownfail.d/durable-v2-delay
@@ -0,0 +1,2 @@
+# In the ad_dc env leases are disabled
+^samba3.smb2.durable-v2-delay.durable_v2_reconnect_delay_msec\(ad_dc\)
diff --git a/selftest/knownfail.d/empty-domain-name b/selftest/knownfail.d/empty-domain-name
new file mode 100644
index 0000000..a1ffcaf
--- /dev/null
+++ b/selftest/knownfail.d/empty-domain-name
@@ -0,0 +1,7 @@
+^samba3.blackbox.smbclient_auth.empty_domain.domain_creds.smbclient.*as.user.*nt4_member
+^samba3.blackbox.smbclient_auth.empty_domain.domain_creds.smbclient.*as.user.*ad_member
+^samba3.blackbox.smbclient_auth.dot_domain.domain_creds.smbclient.*as.user.*nt4_member
+^samba3.blackbox.smbclient_auth.dot_domain.domain_creds.smbclient.*as.user.*ad_member
+^samba3.blackbox.smbclient_auth.upn.domain_creds.smbclient.*as.*user.*nt4_member
+^samba3.blackbox.smbclient_auth.upn.member_creds.smbclient.*as.*user.*nt4_member
+^samba3.blackbox.smbclient_auth.upn.member_creds.smbclient.*as.*user.*ad_member
diff --git a/selftest/knownfail.d/encrypted_secrets b/selftest/knownfail.d/encrypted_secrets
new file mode 100644
index 0000000..e25a68d
--- /dev/null
+++ b/selftest/knownfail.d/encrypted_secrets
@@ -0,0 +1,13 @@
+# The fl2000dc environment is provisioned with the --plaintext-secrets option
+# running the ecnrypted secrets tests on it and expecting them to fail.
+# verifies that:
+#   * --plaintext-secrets option correctly provisions a domain
+#   * the dsdb operational module correctly handles unencrypted secrets
+#   * secrets are not stored as encrypted text when this option is specified
+^samba.tests.encrypted_secrets.samba.tests.encrypted_secrets.EncryptedSecretsTests.test_encrypted_secrets\(fl2000dc:local\)
+^samba.tests.encrypted_secrets.samba.tests.encrypted_secrets.EncryptedSecretsTests.test_required_features\(fl2000dc:local\)
+#
+# The tests for bug 13563 https://bugzilla.samba.org/show_bug.cgi?id=13653
+# should fail in the mdb case, as sam.ldb is currently a tdb file.
+#
+^samba.tests.blackbox.bug13653.samba.tests.blackbox.bug13653.Bug13653Tests.test_mdb_scheme
diff --git a/selftest/knownfail.d/getncchanges b/selftest/knownfail.d/getncchanges
new file mode 100644
index 0000000..bda9b31
--- /dev/null
+++ b/selftest/knownfail.d/getncchanges
@@ -0,0 +1,8 @@
+# GET_TGT tests currently only work for testenvs that send the links at the
+# same time as the source objects. Currently this is only the vampire_dc
+samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt\(promoted_dc\)
+samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt_chain\(promoted_dc\)
+samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt_and_anc\(promoted_dc\)
+samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt_multivalued_links\(promoted_dc\)
+# Samba chooses to always increment the USN for the NC root at the point where it would otherwise show up.
+samba4.drs.getncchanges.python\(.*\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_nc_is_first_nc_change_only\(
diff --git a/selftest/knownfail.d/initshutdown b/selftest/knownfail.d/initshutdown
new file mode 100644
index 0000000..0e8d76a
--- /dev/null
+++ b/selftest/knownfail.d/initshutdown
@@ -0,0 +1,3 @@
+# the initshutdown pipe is not provided by the AD DC
+^samba3.rpc.initshutdown.initshutdown.InitEx\(ad_dc\)
+^samba3.rpc.initshutdown.initshutdown.Init\(ad_dc\)
diff --git a/selftest/knownfail.d/kdc-salt b/selftest/knownfail.d/kdc-salt
new file mode 100644
index 0000000..a671e4d
--- /dev/null
+++ b/selftest/knownfail.d/kdc-salt
@@ -0,0 +1 @@
+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_upn_at_realm_user
diff --git a/selftest/knownfail.d/keytab b/selftest/knownfail.d/keytab
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/selftest/knownfail.d/keytab
diff --git a/selftest/knownfail.d/kinit_trust b/selftest/knownfail.d/kinit_trust
new file mode 100644
index 0000000..c4ac2ca
--- /dev/null
+++ b/selftest/knownfail.d/kinit_trust
@@ -0,0 +1,2 @@
+^samba4.blackbox.kinit_trust.Test login with.*kerberos ccache \(smbclient4\)\(fl2008r2dc:local\)
+^samba4.blackbox.kinit_trust.Test login with.* kerberos ccache \(smbclient4\)\(fl2003dc:local\)
diff --git a/selftest/knownfail.d/krb5-no-preauth b/selftest/knownfail.d/krb5-no-preauth
new file mode 100644
index 0000000..d6f20d0
--- /dev/null
+++ b/selftest/knownfail.d/krb5-no-preauth
@@ -0,0 +1,7 @@
+#
+# MIT and Heimdal currently fails some as_req_no_preauth tests against FL 2003.  It is unclear if we should care.
+#
+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_enc_timestamp_aes128_rc4.*fl2003dc
+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_enc_timestamp_mac_aes128_rc4.*fl2003dc
+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth.*aes.*rc4.*fl2003dc
+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth.*rc4.*aes.*fl2003dc
diff --git a/selftest/knownfail.d/labdc b/selftest/knownfail.d/labdc
new file mode 100644
index 0000000..65eafd5
--- /dev/null
+++ b/selftest/knownfail.d/labdc
@@ -0,0 +1,5 @@
+# Because the lab-DC testenv scrubs all user info (apart from the Admin),
+# we expect tests relying on other users' credentials to fail.
+# These tests fail because they use testallowed and testdenied users.
+^samba4.rpc.echo.testallowed.*labdc.*
+^samba4.rpc.echo.testdenied.*labdc.*
diff --git a/selftest/knownfail.d/ldap b/selftest/knownfail.d/ldap
new file mode 100644
index 0000000..0331d36
--- /dev/null
+++ b/selftest/knownfail.d/ldap
@@ -0,0 +1,3 @@
+# the attributes too long test returns the wrong error
+^samba4.ldap.python.+test_attribute_ranges_too_long
+samba4.ldap.python\(ad_dc_default\).*__main__.BasicTests.test_ldapSearchNoAttributes
diff --git a/selftest/knownfail.d/ldap_spn b/selftest/knownfail.d/ldap_spn
new file mode 100644
index 0000000..63f9fe0
--- /dev/null
+++ b/selftest/knownfail.d/ldap_spn
@@ -0,0 +1 @@
+samba.tests.ldap_spn.+LdapSpnTest.test_spn_dodgy_spns
diff --git a/selftest/knownfail.d/lm-hash-support-gone b/selftest/knownfail.d/lm-hash-support-gone
new file mode 100644
index 0000000..cced585
--- /dev/null
+++ b/selftest/knownfail.d/lm-hash-support-gone
@@ -0,0 +1,8 @@
+^samba4.blackbox.smbclient .*LANMAN*
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics_lm\(ad_dc:local\)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics_lm\(ad_member:local\)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics_lm\(chgdcpass:local\)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics_lm\(rodc:local\)
+# These fail as they expect no LM support (compared with the _lm test test does)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics\(nt4_dc:local\)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics\(nt4_member:local\)
diff --git a/selftest/knownfail.d/lzxpress b/selftest/knownfail.d/lzxpress
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/selftest/knownfail.d/lzxpress
diff --git a/selftest/knownfail.d/modify-order b/selftest/knownfail.d/modify-order
new file mode 100644
index 0000000..76d538e
--- /dev/null
+++ b/selftest/knownfail.d/modify-order
@@ -0,0 +1,8 @@
+samba4.ldap_modify_order.python.+ModifyOrderTests.test_modify_order_account_locality_device
+samba4.ldap_modify_order.python.+ModifyOrderTests.test_modify_order_container_flags_multivalue
+samba4.ldap_modify_order.python.+ModifyOrderTests.test_modify_order_objectclass2
+samba4.ldap_modify_order.python.+ModifyOrderTests.test_modify_order_singlevalue
+samba4.ldap_modify_order.normal_user.+ModifyOrderTests.test_modify_order_account_locality_device
+samba4.ldap_modify_order.normal_user.+ModifyOrderTests.test_modify_order_container_flags[^_]
+samba4.ldap_modify_order.normal_user.+ModifyOrderTests.test_modify_order_objectclass[^2]
+samba4.ldap_modify_order.normal_user.+ModifyOrderTests.test_modify_order_objectclass2
diff --git a/selftest/knownfail.d/multichannel b/selftest/knownfail.d/multichannel
new file mode 100644
index 0000000..6c91b55
--- /dev/null
+++ b/selftest/knownfail.d/multichannel
@@ -0,0 +1,7 @@
+^samba3.smb2.multichannel.oplocks.test2.nt4_dc              # expects windows behavior => smb2 disable oplock break retry = yes
+^samba3.smb2.multichannel.oplocks.test3_windows.nt4_dc      # expects windows behavior => smb2 disable oplock break retry = yes
+^samba3.smb2.multichannel.oplocks.test3_specification.ad_dc # expects samba (MS-SMB2) behavior
+^samba3.smb2.multichannel.leases.test1.ad_dc                # requires lease support
+^samba3.smb2.multichannel.leases.test2.ad_dc                # requires lease support
+^samba3.smb2.multichannel.leases.test3.ad_dc                # requires lease support
+^samba3.smb2.multichannel.leases.test4.ad_dc                # requires lease support
diff --git a/selftest/knownfail.d/netlogon b/selftest/knownfail.d/netlogon
new file mode 100644
index 0000000..b51bf88
--- /dev/null
+++ b/selftest/knownfail.d/netlogon
@@ -0,0 +1,4 @@
+# This test passes against Windows 2008R2, but not Samba as we
+# keep a per-socket cache in addition to the name cache, which is
+# not invalidated if the name-based global cache is used.
+^samba4\.rpc\.netlogon.*\.netlogon\.ServerReqChallengeReuseGlobal3
\ No newline at end of file
diff --git a/selftest/knownfail.d/nt-hash-support-gone b/selftest/knownfail.d/nt-hash-support-gone
new file mode 100644
index 0000000..55ec47d
--- /dev/null
+++ b/selftest/knownfail.d/nt-hash-support-gone
@@ -0,0 +1,9 @@
+^samba4.ldap.login_basics.python.ad_dc_no_ntlm..__main__.BasicUserAuthTests.test_login_basics_ntlm.ad_dc_no_ntlm
+^samba4.ldap.passwords.python.ad_dc_no_ntlm..__main__.PasswordTests.test_old_password_rename_attempt_reuse_2.ad_dc_no_ntlm
+^samba4.ldap.passwords.python.ad_dc_no_ntlm..__main__.PasswordTests.test_old_password_rename_simple_bind_2.ad_dc_no_ntlm
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_attempt_reuse.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_rename_attempt_reuse.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_rename_attempt_reuse_2.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_rename_simple_bind.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_rename_simple_bind_2.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_simple_bind.fl2003dc
diff --git a/selftest/knownfail.d/ntlmv1-restrictions b/selftest/knownfail.d/ntlmv1-restrictions
new file mode 100644
index 0000000..c5e915a
--- /dev/null
+++ b/selftest/knownfail.d/ntlmv1-restrictions
@@ -0,0 +1,5 @@
+# These tests should fail in these environments, as we restrict NTLMv1
+# in both of these, with vampire_dc however allowing MSCHAPv2
+samba.tests.py_credentials.samba.tests.py_credentials.PyCredentialsTests.test_SamLogonExNTLM\(vampire_dc\)
+samba.tests.py_credentials.samba.tests.py_credentials.PyCredentialsTests.test_SamLogonExMSCHAPv2\(promoted_dc\)
+samba.tests.py_credentials.samba.tests.py_credentials.PyCredentialsTests.test_SamLogonExNTLM\(promoted_dc\)
diff --git a/selftest/knownfail.d/ntlmv2-restrictions b/selftest/knownfail.d/ntlmv2-restrictions
new file mode 100644
index 0000000..cc67df8
--- /dev/null
+++ b/selftest/knownfail.d/ntlmv2-restrictions
@@ -0,0 +1,2 @@
+# 'raw NTLMv2 auth' is not enabled on ad_member
+^samba4.smb.signing disabled on with -k no --option=clientusespnego=no --client-protection=off domain-creds.xcopy\(ad_member\)
diff --git a/selftest/knownfail.d/oneway b/selftest/knownfail.d/oneway
new file mode 100644
index 0000000..4a182f0
--- /dev/null
+++ b/selftest/knownfail.d/oneway
@@ -0,0 +1,9 @@
+# One way trust, the first one is weird (smbclient4), the rest are logical
+^samba4.blackbox.kinit_trust.Test login with user kerberos ccache \(smbclient4\)\(fl2000dc:local\)
+^samba4.blackbox.kinit_trust.Test user login with the first outgoing secret\(fl2000dc:local\)
+^samba4.blackbox.kinit_trust.Test user login with the changed outgoing secret\(fl2000dc:local\)
+# More one-way trust
+^samba4.blackbox.trust_utils\(fl2000dc:local\).validate trust default both\(fl2000dc:local\)
+^samba4.blackbox.trust_utils\(fl2000dc:local\).validate trust reverse both\(fl2000dc:local\)
+^samba4.blackbox.trust_utils\(fl2000dc:local\).validate trust reverse local\(fl2000dc:local\)
+^samba4.blackbox.trust_utils\(fl2000dc:local\).namespaces own default\(fl2000dc:local\)
diff --git a/selftest/knownfail.d/priv_attr b/selftest/knownfail.d/priv_attr
new file mode 100644
index 0000000..5d3713e
--- /dev/null
+++ b/selftest/knownfail.d/priv_attr
@@ -0,0 +1,13 @@
+# These priv_attrs tests would be good to fix, but are not fatal as
+# the testsuite is run twice, once with and once without STRICT_CHECKING=0
+#
+# These knownfails show that we can improve our error matching against Windows.
+#
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_CC_WP_computer
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_CC_WP_user
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_CC_default_computer
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_CC_default_user
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_admin-add_WP_computer
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_admin-add_WP_user
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_admin-add_default_computer
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_admin-add_default_user
diff --git a/selftest/knownfail.d/protected_users b/selftest/knownfail.d/protected_users
new file mode 100644
index 0000000..1ada787
--- /dev/null
+++ b/selftest/knownfail.d/protected_users
@@ -0,0 +1,2 @@
+^samba4.ldap.password_lockout.python\(ad_dc_slowtests\).__main__.PasswordTestsWithoutSleep.test_samr_change_password_protected.ad_dc_slowtests
+^samba4.ldap.password_lockout.python\(ad_dc_slowtests\).__main__.PasswordTestsWithoutSleep.test_samr_set_password_protected.ad_dc_slowtests
diff --git a/selftest/knownfail.d/python-segfaults b/selftest/knownfail.d/python-segfaults
new file mode 100644
index 0000000..d129dab
--- /dev/null
+++ b/selftest/knownfail.d/python-segfaults
@@ -0,0 +1,3 @@
+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3
+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dnsp_string_list
+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dns_record
diff --git a/selftest/knownfail.d/quota1 b/selftest/knownfail.d/quota1
new file mode 100644
index 0000000..a36f325
--- /dev/null
+++ b/selftest/knownfail.d/quota1
@@ -0,0 +1,2 @@
+# ntvfs returns NT_STATUS_NOT_SUPPORTED
+^samba3.smbtorture_s3.plain.SMB2-QUOTA1.smbtorture\(ad_dc_ntvfs\)
diff --git a/selftest/knownfail.d/replica_sync b/selftest/knownfail.d/replica_sync
new file mode 100644
index 0000000..1ef77b0
--- /dev/null
+++ b/selftest/knownfail.d/replica_sync
@@ -0,0 +1,8 @@
+# Samba currently picks a different winner of object conflicts compared to Windows.
+# Samba uses the version number whereas Windows always takes the most recent change
+samba4.drs.replica_sync.python\(vampire_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplConflictsRenamedVsNewRemoteWin\(vampire_dc:local\)
+samba4.drs.replica_sync.python\(promoted_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplConflictsRenamedVsNewRemoteWin\(promoted_dc:local\)
+samba4.drs.replica_sync.python\(vampire_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplConflictsRenamedVsNewLocalWin\(vampire_dc:local\)
+samba4.drs.replica_sync.python\(promoted_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplConflictsRenamedVsNewLocalWin\(promoted_dc:local\)
+samba4.drs.replica_sync.python\(vampire_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplReanimationConflict\(vampire_dc:local\)
+samba4.drs.replica_sync.python\(promoted_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplReanimationConflict\(promoted_dc:local\)
diff --git a/selftest/knownfail.d/rpc-dfs b/selftest/knownfail.d/rpc-dfs
new file mode 100644
index 0000000..8ab72ff
--- /dev/null
+++ b/selftest/knownfail.d/rpc-dfs
@@ -0,0 +1,2 @@
+#_dfs_EnumEx() is not implemented on RPC server side
+^samba3.blackbox.rpcclient_dfs.dfsenumex
diff --git a/selftest/knownfail.d/rpc-netlogon-zerologon b/selftest/knownfail.d/rpc-netlogon-zerologon
new file mode 100644
index 0000000..29d2e6e
--- /dev/null
+++ b/selftest/knownfail.d/rpc-netlogon-zerologon
@@ -0,0 +1,4 @@
+#
+# Due to differences in the way UTF-16 strings are handled by the source4 and
+# source3 rpc servers, this test fails on the source3 rpc server
+^samba3.rpc.netlogon.zerologon.netlogon.test_SetPassword2_maximum_length_password\(nt4_dc\)
diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid
new file mode 100644
index 0000000..ac5fe57
--- /dev/null
+++ b/selftest/knownfail.d/rw-invalid
@@ -0,0 +1 @@
+samba4.smb2.rw.invalid.ad_dc_ntvfs
diff --git a/selftest/knownfail.d/s3-logging b/selftest/knownfail.d/s3-logging
new file mode 100644
index 0000000..76466dc
--- /dev/null
+++ b/selftest/knownfail.d/s3-logging
@@ -0,0 +1 @@
+samba.tests.logfiles.*S3LoggingTests.test_all_different_ways_cmdline_d\b
diff --git a/selftest/knownfail.d/s3-lsa-server b/selftest/knownfail.d/s3-lsa-server
new file mode 100644
index 0000000..de1244f
--- /dev/null
+++ b/selftest/knownfail.d/s3-lsa-server
@@ -0,0 +1 @@
+^samba4.blackbox.trust_ntlm.Test08.rpcclient.lookupnames.with.ADDOM.SAMBA.EXAMPLE.COM\(ad_member:local\)
diff --git a/selftest/knownfail.d/samba-4.5-emulation b/selftest/knownfail.d/samba-4.5-emulation
new file mode 100644
index 0000000..1fc7936
--- /dev/null
+++ b/selftest/knownfail.d/samba-4.5-emulation
@@ -0,0 +1,4 @@
+# This fails as there is no second DC in this enviroment, so it is always the owner
+samba4.drs.getnc_exop.python\(chgdcpass\).getnc_exop.DrsReplicaSyncTestCase.test_FSMONotOwner\(chgdcpass\)
+# This fails because GET_ANC is now poorly implemented (matching Samba 4.5)
+^samba4.drs.getnc_exop.python\(chgdcpass\).getnc_exop.DrsReplicaSyncTestCase.test_link_utdv_hwm\(chgdcpass\)
diff --git a/selftest/knownfail.d/samba3.vfs.fruit b/selftest/knownfail.d/samba3.vfs.fruit
new file mode 100644
index 0000000..6307e2b
--- /dev/null
+++ b/selftest/knownfail.d/samba3.vfs.fruit
@@ -0,0 +1,2 @@
+^samba3.vfs.fruit streams_depot.OS X AppleDouble file conversion\(nt4_dc\)
+^samba3.vfs.fruit streams_depot.OS X AppleDouble file conversion without embedded xattr\(nt4_dc\)
diff --git a/selftest/knownfail.d/sid-strings b/selftest/knownfail.d/sid-strings
new file mode 100644
index 0000000..6953643
--- /dev/null
+++ b/selftest/knownfail.d/sid-strings
@@ -0,0 +1,3 @@
+^samba.tests.sid_strings.samba.tests.sid_strings.SidStringTests.test_sid_string_Aa.ad_dc
+^samba.tests.sid_strings.samba.tests.sid_strings.SidStringTests.test_sid_string_aA.ad_dc
+^samba.tests.sid_strings.samba.tests.sid_strings.SidStringTests.test_sid_string_aa.ad_dc
diff --git a/selftest/knownfail.d/smb1-tests b/selftest/knownfail.d/smb1-tests
new file mode 100644
index 0000000..b5263f2
--- /dev/null
+++ b/selftest/knownfail.d/smb1-tests
@@ -0,0 +1,52 @@
+^samba3.blackbox.smbclient_ntlm.plain.*NT1.smbclient username.password.NT1OLD\((ad_member|fl2000dc|nt4_member)\)
+^samba3.blackbox.smbclient_ntlm.plain.*NT1.smbclient username.password.NT1NEW\((ad_member|fl2000dc|nt4_member)\)
+^samba3.blackbox.smbclient_ntlm.plain.*NT1.smbclient anonymous.nopassword.NT1OLD\((ad_member|fl2000dc|nt4_member)\)
+^samba3.blackbox.smbclient_ntlm.plain.*NT1.smbclient anonymous.nopassword.NT1NEW\((ad_member|fl2000dc|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.smbclient -L.*\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.smbclient -L LOCALADMEMBER -I.*\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.noninteractive smbclient does not prompt\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.noninteractive smbclient -l does not prompt\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.interactive smbclient prompts on stdout\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.interactive smbclient -l prompts on stdout\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.creating a bad symlink and deleting it\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Accessing an MS-DFS link\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.del on MS-DFS share\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.deltree on MS-DFS share\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Ensure archive bit is set correctly on file/dir rename\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.ccache access works for smbclient\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.using an authentication file\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.list with backup privilege\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.list a share with bad names \(won't convert\)\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.list a share with a mangled name \+ acl_xattr object\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.server-side file copy\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Ensure widelinks are restricted\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.stream_xattr attributes\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.follow symlinks = no\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.smbclient deltree command\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.server os message\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.test server quiet message\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.setmode test\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.utimes\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.rename_dotdot\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.volume\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.delete a non empty directory\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Recursive ls across MS-DFS links\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Hardlink on MS-DFS share\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Rename on MS-DFS share\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.*valid.users.nt4.*
+^samba3.blackbox.smbclient_s3.NT1.*valid.users.*
+^samba3.unix.whoami machine account.whoami\(ad_member:local\)
+^samba3.unix.whoami.whoami\(nt4_member\)
+^samba3.unix.whoami anonymous connection.whoami\(nt4_member\)
+^samba3.unix.whoami.whoami\(ad_member\)
+^samba3.unix.whoami kerberos connection.whoami\(ad_member\)
+^samba3.unix.whoami anonymous connection.whoami\(ad_member\)
+^samba3.unix.whoami ntlm user@realm.whoami\(ad_member\)
+^samba4.smb.signing disabled on with -k no --client-protection=off domain-creds.xcopy\(ad_member\)
+^samba4.smb.signing disabled on with -k no --option=gensec:spengo=no --client-protection=off domain-creds.xcopy\(ad_member\)
+^samba4.smb.signing disabled on with -k yes --client-protection=off domain-creds.xcopy\(ad_member\)
+^samba4.blackbox.smbclient\(ad_member:local\).Test login with --machine-pass without kerberos\(ad_member:local\)
+^samba4.blackbox.smbclient\(ad_member:local\).Test login with --machine-pass and kerberos\(ad_member:local\)
+^samba4.blackbox.smbclient\(chgdcpass:local\).Test login with --machine-pass without kerberos\(chgdcpass:local\)
+^samba4.blackbox.smbclient\(chgdcpass:local\).Test login with --machine-pass and kerberos\(chgdcpass:local\)
+^samba3.blackbox.smbclient_basic.NT1.smbclient as NT4SCHANNEL.*\(nt4_dc_schannel\)
diff --git a/selftest/knownfail.d/smb2.replay b/selftest/knownfail.d/smb2.replay
new file mode 100644
index 0000000..4cac807
--- /dev/null
+++ b/selftest/knownfail.d/smb2.replay
@@ -0,0 +1,29 @@
+# These tests demonstrate the broken Windows behavior
+# and check for ACCESS_DENIED instead of FILE_NOT_AVAILABLE
+# See https://bugzilla.samba.org/show_bug.cgi?id=14449
+^samba3.smb2.replay.dhv2-pending1n-vs-violation-lease-close-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1n-vs-violation-lease-ack-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1n-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1n-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1l-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1l-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1o-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1o-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2n-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2n-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2l-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2l-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2o-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2o-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3n-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3n-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3l-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3l-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3o-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3o-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1n-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending1o-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending2n-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending2o-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending3n-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending3o-vs-oplock-windows.ad_dc
diff --git a/selftest/knownfail.d/smb2.session b/selftest/knownfail.d/smb2.session
new file mode 100644
index 0000000..a85fb37
--- /dev/null
+++ b/selftest/knownfail.d/smb2.session
@@ -0,0 +1,4 @@
+# These tests fail with INVALID_PARAMETER as
+# we required the same client guid for session binds
+^samba3.smb2.session.*.bind_negative_smb3signCtoHd
+^samba3.smb2.session.*.bind_negative_smb3signHtoCd
diff --git a/selftest/knownfail.d/smbcacls b/selftest/knownfail.d/smbcacls
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/selftest/knownfail.d/smbcacls
diff --git a/selftest/knownfail.d/smbclient-smb3 b/selftest/knownfail.d/smbclient-smb3
new file mode 100644
index 0000000..119e93e
--- /dev/null
+++ b/selftest/knownfail.d/smbclient-smb3
@@ -0,0 +1,5 @@
+^samba3.blackbox.smbclient_s3.SMB3.*.creating.a.bad.symlink.and.deleting.it
+^samba3.blackbox.acl_xattr.SMB3.nt_affects_posix
+^samba3.blackbox.acl_xattr.SMB3.nt_affects_chown
+^samba3.blackbox.acl_xattr.SMB3.nt_affects_chgrp
+^samba3.blackbox.inherit_owner.*.SMB3.*unix.owner
diff --git a/selftest/knownfail.d/source3-epmapper b/selftest/knownfail.d/source3-epmapper
new file mode 100644
index 0000000..0a731ec
--- /dev/null
+++ b/selftest/knownfail.d/source3-epmapper
@@ -0,0 +1,2 @@
+^samba3.rpc.epmapper\ over\ ncalrpc.epmapper.Map_full\(nt4_dc:local\)
+^samba3.rpc.epmapper\ over\ ncalrpc.epmapper.Insert_noreplace\(nt4_dc:local\)
diff --git a/selftest/knownfail.d/srvsvc b/selftest/knownfail.d/srvsvc
new file mode 100644
index 0000000..63444c8
--- /dev/null
+++ b/selftest/knownfail.d/srvsvc
@@ -0,0 +1,24 @@
+# Except where noted these are missing RPCs with just give a simple
+# fault (mapped to NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareGetInfo\(ad_member\)
+# Level 501 is supported in the s3 srvsrv server
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetTransportEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareEnumAll\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetCharDevQEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetCharDevEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareGetInfo\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareEnumAll\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareGetInfo\(ad_dc\)
+# Level 501 is supported in the s3 srvsrv server
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareEnum\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetTransportEnum\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareEnumAll\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetCharDevQEnum\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetCharDevEnum\(ad_dc\)
+# These should be fixed by setting 'restrict anonymous = 2' by default
+# per https://bugzilla.samba.org/show_bug.cgi?id=12775
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareGetInfo\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareEnum\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareEnumAll\(ad_dc\)
diff --git a/selftest/knownfail.d/uac_objectclass_restrict b/selftest/knownfail.d/uac_objectclass_restrict
new file mode 100644
index 0000000..a9ed5e8
--- /dev/null
+++ b/selftest/knownfail.d/uac_objectclass_restrict
@@ -0,0 +1,17 @@
+# Knownfail entries due to restricting the creation of computer/user
+# accounts (in terms of userAccountControl) that do not match the objectclass
+#
+# All these tests need to be fixed and the entries here removed
+
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-DC_add_CC_WP_user\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-DC_add_CC_default_user\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-a2d-user_add_CC_WP_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-a2d-user_add_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-a2d-user_mod-del-add_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-a2d-user_mod-replace_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-t4d-user_add_CC_WP_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-t4d-user_add_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-t4d-user_mod-del-add_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-t4d-user_mod-replace_CC_default_computer\(ad_dc_default\)
+^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_add_computer_sd_cc\(ad_dc_default\)
+^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_mod_computer_cc\(ad_dc_default\)
diff --git a/selftest/knownfail.d/upn_handling b/selftest/knownfail.d/upn_handling
new file mode 100644
index 0000000..bcbedb4
--- /dev/null
+++ b/selftest/knownfail.d/upn_handling
@@ -0,0 +1,8 @@
+^samba3\.wbinfo_user_info\.name_to_sid\.upn\.testdenied_upn.ad_member
+^samba3\.wbinfo_user_info\.user_info\.upn\.testdenied_upn.ad_member
+^samba3\.wbinfo_user_info\.user_info\.domain\.alice.fl2008r2dc
+^samba3\.wbinfo_user_info\.user_info\.upn\.alice.fl2008r2dc
+^samba3\.wbinfo_user_info\.user_info\.domain\.jane.fl2008r2dc
+^samba3\.wbinfo_user_info\.user_info\.upn\.jane\.doe.fl2008r2dc
+^samba3\.wbinfo_user_info\.name_to_sid\.upn\.testdenied_upn.fl2008r2dc
+^samba3\.wbinfo_user_info\.user_info\.upn\.testdenied_upn.fl2008r2dc
diff --git a/selftest/knownfail.d/usage b/selftest/knownfail.d/usage
new file mode 100644
index 0000000..b8e0bbc
--- /dev/null
+++ b/selftest/knownfail.d/usage
@@ -0,0 +1,35 @@
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_autobuild_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_compare_cc_results_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_config_base.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_ctdb_etcd_lock.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_depfilter_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_dns_hub_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_gen_hresult_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_repl_cleartext_pwd_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_run_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_run_py_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_smbstatus.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_tests_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_tests_py_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_waf.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_chgtdcpass.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_findprovisionusnranges.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_machineaccountpw.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_rebuildextendeddn.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_renamedc.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_repl_cleartext_pwd_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_rodcdns.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_gpupdate.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_gpupdate_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_kcc.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_kcc_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_spnupdate.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_spnupdate_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_upgradedns.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_upgradedns_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_upgradeprovision.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_upgradeprovision_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_smbstatus.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_test_s3_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_test_s4_howto_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_traffic_learner.none.
diff --git a/selftest/knownfail.d/vlv b/selftest/knownfail.d/vlv
new file mode 100644
index 0000000..7ae02ba
--- /dev/null
+++ b/selftest/knownfail.d/vlv
@@ -0,0 +1,2 @@
+samba4.ldap.vlv.python.*__main__.VLVTests.test_vlv_change_search_expr
+samba4.ldap.vlv.python.*__main__.PagedResultsTestsRW.test_paged_cant_change_controls_data
diff --git a/selftest/knownfail.d/wkssvc b/selftest/knownfail.d/wkssvc
new file mode 100644
index 0000000..37a0e67
--- /dev/null
+++ b/selftest/knownfail.d/wkssvc
@@ -0,0 +1,25 @@
+# We do not have a full implementation of wkssvc in source3, but we
+# have something worth testing
+samba3.rpc.wkssvc.wkssvc.NetrMessageBufferSend\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrWorkstationStatisticsGet\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrGetJoinableOus2\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrGetJoinableOus\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrGetJoinInformation\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUnjoinDomain\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrJoinDomain\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrEnumerateComputerNames\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrAddAlternateComputerName\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrRemoveAlternateComputerName\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrLogonDomainNameAdd\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrLogonDomainNameDel\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrValidateName2\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrValidateName\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUseAdd\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUseEnum\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUseGetInfo\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUseDel\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrWkstaUserGetInfo\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrWkstaTransportAdd\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrWkstaTransportDel\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetWkstaTransportEnum\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetWkstaGetInfo\(ad_member\)