Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

59 files changed, 659 insertions, 0 deletions

diff --git a/selftest/knownfail.d/README b/selftest/knownfail.d/README
new file mode 100644
index 0000000..ca6c7a5
--- /dev/null
+++ b/selftest/knownfail.d/README
@@ -0,0 +1,12 @@
+# Files in this directory contain lists of regular expressions
+# matching the names of tests that are temporarily expected to fail.
+#
+# Tests that are intended to *always* fail (e.g. to prove that the
+# test can't succeed under certain conditions) should be added under
+# selftest/expectedfail.d instead.
+#
+# "make test" will not report failures for tests listed here and will consider
+# a successful run for any of these tests an error.
+#
+# Empty lines and lines beginning with '#' are ignored.
+# Please don't add tests to this README!
diff --git a/selftest/knownfail.d/bug-14810 b/selftest/knownfail.d/bug-14810
new file mode 100644
index 0000000..b96e990
--- /dev/null
+++ b/selftest/knownfail.d/bug-14810
@@ -0,0 +1,2 @@
+^samba4.user_account_control.python\(.*\).__main__.UserAccountControlTests.test_add_computer_cc_normal_bare\(.*\)
+^samba4.user_account_control.python\(.*\).__main__.UserAccountControlTests.test_add_computer_sd_cc\(.*\)
diff --git a/selftest/knownfail.d/claims-client-tool b/selftest/knownfail.d/claims-client-tool
new file mode 100644
index 0000000..549efad
--- /dev/null
+++ b/selftest/knownfail.d/claims-client-tool
@@ -0,0 +1 @@
+^samba.tests.samba_tool.domain_claim.samba.tests.samba_tool.domain_claim.ClaimTypeCmdTestCase.test_delete__protected\(.*\)
diff --git a/selftest/knownfail.d/complex_expressions b/selftest/knownfail.d/complex_expressions
new file mode 100644
index 0000000..8ec468a
--- /dev/null
+++ b/selftest/knownfail.d/complex_expressions
@@ -0,0 +1,4 @@
+# Ldb accepts invalid search expressions and returns weird results.
+.*samba.tests.complex_expressions.ComplexExpressionTests.test_largeint_invalid_expressions.*
+.*samba.tests.complex_expressions.ComplexExpressionTests.test_enum_invalid_expressions.*
+.*samba.tests.complex_expressions.ComplexExpressionTests.test_invalid_expressions.*
diff --git a/selftest/knownfail.d/conditional_ace_claims b/selftest/knownfail.d/conditional_ace_claims
new file mode 100644
index 0000000..40e342a
--- /dev/null
+++ b/selftest/knownfail.d/conditional_ace_claims
@@ -0,0 +1 @@
+^samba.tests.conditional_ace_claims.+ConditionalAceLargeComposites.test_allow_002-0-vs-0
diff --git a/selftest/knownfail.d/dfs_paths b/selftest/knownfail.d/dfs_paths
new file mode 100644
index 0000000..fb7b832
--- /dev/null
+++ b/selftest/knownfail.d/dfs_paths
@@ -0,0 +1,2 @@
+^samba3.smbtorture_s3.smb1.SMB1-DFS-PATHS.smbtorture\(fileserver_smb1\)
+^samba3.smbtorture_s3.smb1.SMB1-DFS-OPERATIONS.smbtorture\(fileserver_smb1\)
diff --git a/selftest/knownfail.d/dirsync b/selftest/knownfail.d/dirsync
new file mode 100644
index 0000000..fcf4d46
--- /dev/null
+++ b/selftest/knownfail.d/dirsync
@@ -0,0 +1,13 @@
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_OBJECT_SECURITY_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_unicodePwd_OBJ_SEC_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_unicodePwd_with_GET_CHANGES_OBJ_SEC_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_unicodePwd_with_GET_CHANGES_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_with_GET_CHANGES_OBJECT_SECURITY_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialDirsyncTests.test_dirsync_with_GET_CHANGES\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialFilteredDirsyncTests.test_dirsync_OBJECT_SECURITY_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialFilteredDirsyncTests.test_dirsync_OBJECT_SECURITY_with_GET_CHANGES_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialFilteredDirsyncTests.test_dirsync_with_GET_CHANGES_attr\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.ConfidentialFilteredDirsyncTests.test_dirsync_with_GET_CHANGES_insist_on_empty_element\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.FilteredDirsyncTests.test_dirsync_with_GET_CHANGES\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.FilteredDirsyncTests.test_dirsync_with_GET_CHANGES_attr\(.*\)
+^samba4.ldap.dirsync.python\(.*\).__main__.FilteredDirsyncTests.test_dirsync_with_GET_CHANGES_insist_on_empty_element\(.*\)
diff --git a/selftest/knownfail.d/dns b/selftest/knownfail.d/dns
new file mode 100644
index 0000000..94000e0
--- /dev/null
+++ b/selftest/knownfail.d/dns
@@ -0,0 +1,89 @@
+# These tests are expected to fail because we want to ensure that
+# unauthenticated updates are not permitted against the default
+# configuration, nor against an RODC
+
+samba.tests.dns.__main__.TestDNSUpdates.test_delete_record\(rodc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_readd_record\(rodc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_update_add_mx_record\(rodc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_update_add_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_empty_txt_records\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_hex_char_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_char_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_padded_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_slash_txt_record\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_two_txt_records\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_rpc_self_referencing_cname\(rodc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_delete_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_readd_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_update_add_mx_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestDNSUpdates.test_update_add_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_empty_txt_records\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_hex_char_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_char_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_padded_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_slash_txt_record\(vampire_dc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_two_txt_records\(vampire_dc:local\)
+samba.tests.dns.__main__.TestComplexQueries.test_cname_two_chain\(rodc:local\)
+samba.tests.dns.__main__.TestComplexQueries.test_one_a_query\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_empty_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_hex_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_null_char_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_padding_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_slash_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_two_rpc_to_dns\(rodc:local\)
+samba.tests.dns.__main__.TestRPCRoundtrip.test_update_add_txt_rpc_to_dns\(rodc:local\)
+
+samba.tests.dns.__main__.TestZones.test_set_aging_disabled\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_set_aging_disabled\(vampire_dc:local\)
+
+samba.tests.dns.__main__.TestZones.test_soa_query\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_set_aging\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_update\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_update_disabled\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_refresh\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_rpc_add_no_timestamp\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_basic_scavenging\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_dns_tombstone_custom_match_rule\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_dns_tombstone_custom_match_rule_no_records\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_dns_tombstone_custom_match_rule_fail\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_dynamic_record_static_update\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_static_record_dynamic_update\(rodc:local\)
+samba.tests.dns.__main__.TestZones.test_fully_qualified_zone\(rodc:local\)
+
+samba.tests.dns.__main__.TestZones.test_set_aging\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_update\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_update_disabled\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_aging_refresh\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_basic_scavenging\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_dns_tombstone_custom_match_rule\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_dynamic_record_static_update\(vampire_dc:local\)
+samba.tests.dns.__main__.TestZones.test_static_record_dynamic_update\(vampire_dc:local\)
+
+samba.tests.dns.__main__.TestComplexQueries.test_cname_two_chain\(vampire_dc:local\)
+samba.tests.dns.__main__.TestComplexQueries.test_one_a_query\(vampire_dc:local\)
+
+# The SOA override should not pass against the RODC, it must not overstamp
+samba.tests.dns.__main__.TestSimpleQueries.test_one_SOA_query\(rodc:local\)
+
+#
+# rodc and vampire_dc require signed dns updates, so these tests' setups
+# fail, but they pass on fl2003dc
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_loop\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_loop\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_A\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_A\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_AAAA\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_AAAA\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_SRV\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_record_limit_SRV\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_limit\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_limit\(rodc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_any_query\(vampire_dc:local\)
+^samba.tests.dns.__main__.TestComplexQueries.test_cname_any_query\(rodc:local\)
+
+# Tests for the dnsProperty parse issue do not pass here, but do against fl2003dc
+^samba.tests.dns.__main__.TestZones.test_enum_zones_while_dnsProperty_zero_length\(rodc:local\)
+^samba.tests.dns.__main__.TestZones.test_rpc_zone_update_while_dnsProperty_zero_length\(rodc:local\)
+^samba.tests.dns.__main__.TestZones.test_rpc_zone_update_while_other_dnsProperty_zero_length\(rodc:local\)
+^samba.tests.dns.__main__.TestZones.test_update_while_dnsProperty_zero_length\(rodc:local\)
+^samba.tests.dns.__main__.TestZones.test_update_while_dnsProperty_zero_length\(vampire_dc:local\)
\ No newline at end of file
diff --git a/selftest/knownfail.d/dns-aging b/selftest/knownfail.d/dns-aging
new file mode 100644
index 0000000..dd6998d
--- /dev/null
+++ b/selftest/knownfail.d/dns-aging
@@ -0,0 +1,78 @@
+# known failures for python/samba/tests/dns_aging.py
+#
+# These all pass on Windows, apart from test_basic_scavenging, which
+# fails due to technical issues.
+
+samba.tests.dns_aging.__main__.TestDNSAging.test_aging_refresh
+samba.tests.dns_aging.+test_dns_add_sibling_0_0_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_0_0_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_0_0_days_no_aging
+samba.tests.dns_aging.+test_dns_add_sibling_0_0_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_0_7_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_0_7_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_0_7_days_no_aging
+samba.tests.dns_aging.+test_dns_add_sibling_0_7_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_10_0_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_10_0_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_10_0_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_112_7_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_112_7_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_112_7_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_113_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_12_113_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_113_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_3_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_12_3_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_3_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_7_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_12_7_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_12_7_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_2_7_days_aging
+samba.tests.dns_aging.+test_dns_add_sibling_2_7_days_aging_touch
+samba.tests.dns_aging.+test_dns_add_sibling_2_7_days_no_aging_touch
+samba.tests.dns_aging.+test_add_update_dwSerial
+samba.tests.dns_aging.+test_add_update_dwSerial_2
+samba.tests.dns_aging.+test_add_update_many
+samba.tests.dns_aging.+test_add_update_ttl_serial
+samba.tests.dns_aging.+test_dns_delete_simple_0_0_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_0_113_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_10_0_days_aging
+samba.tests.dns_aging.+test_dns_delete_simple_10_0_days_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_10_0_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_112_113_days_aging
+samba.tests.dns_aging.+test_dns_delete_simple_112_113_days_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_112_113_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_12_13_days_aging
+samba.tests.dns_aging.+test_dns_delete_simple_12_13_days_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_12_13_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_2_13_days_no_aging_touch
+samba.tests.dns_aging.+test_dns_delete_simple_2_3_days_no_aging_touch
+samba.tests.dns_aging.+test_dynamic_record_static_update
+samba.tests.dns_aging.+test_multi_records_delete_aging
+samba.tests.dns_aging.+test_static_record_dynamic_update
+samba.tests.dns_aging.+test_update_aging_disabled\b
+samba.tests.dns_aging.+test_update_aging_disabled_beyond_refresh_window
+samba.tests.dns_aging.+test_update_aging_disabled_in_eighteenth_century
+samba.tests.dns_aging.+test_update_aging_disabled_in_no_refresh_window
+samba.tests.dns_aging.+test_update_aging_disabled_in_refresh_window
+samba.tests.dns_aging.+test_update_aging_disabled_on_no_refresh_boundary
+samba.tests.dns_aging.+test_update_aging_disabled_static
+samba.tests.dns_aging.+test_update_aging_enabled
+samba.tests.dns_aging.+test_update_aging_enabled_beyond_refresh_window
+samba.tests.dns_aging.+test_update_aging_enabled_in_eighteenth_century
+samba.tests.dns_aging.+test_update_aging_enabled_in_no_refresh_window
+samba.tests.dns_aging.+test_update_aging_enabled_in_refresh_window
+samba.tests.dns_aging.+test_update_aging_enabled_on_no_refresh_boundary
+samba.tests.dns_aging.+test_update_static_stickiness
+samba.tests.dns_aging.+test_update_timestamp_weirdness_no_refresh_no_aging
+samba.tests.dns_aging.+test_update_timestamp_weirdness_refresh_no_aging
+samba.tests.dns_aging.+test_AAAA_5_days_AAAA_6_days_aging
+samba.tests.dns_aging.+test_A_10_days_AAAA_5_days_aging
+samba.tests.dns_aging.+test_A_10_days_AAAA_5_days_no_aging
+samba.tests.dns_aging.+test_A_10_days_AAAA_9_days_aging
+samba.tests.dns_aging.+test_A_20_days_AAAA_2_days_aging
+samba.tests.dns_aging.+test_A_5_days_AAAA_10_days_aging
+samba.tests.dns_aging.+test_A_5_days_AAAA_5_days_aging
+samba.tests.dns_aging.+test_A_5_days_A_5_days_aging
+samba.tests.dns_aging.+test_A_9_days_AAAA_10_days_no_aging
+samba.tests.dns_aging.+test_samba_scavenging
diff --git a/selftest/knownfail.d/durable-v2-delay b/selftest/knownfail.d/durable-v2-delay
new file mode 100644
index 0000000..2a84749
--- /dev/null
+++ b/selftest/knownfail.d/durable-v2-delay
@@ -0,0 +1,2 @@
+# In the ad_dc env leases are disabled
+^samba3.smb2.durable-v2-delay.durable_v2_reconnect_delay_msec\(ad_dc\)
diff --git a/selftest/knownfail.d/empty-domain-name b/selftest/knownfail.d/empty-domain-name
new file mode 100644
index 0000000..a1ffcaf
--- /dev/null
+++ b/selftest/knownfail.d/empty-domain-name
@@ -0,0 +1,7 @@
+^samba3.blackbox.smbclient_auth.empty_domain.domain_creds.smbclient.*as.user.*nt4_member
+^samba3.blackbox.smbclient_auth.empty_domain.domain_creds.smbclient.*as.user.*ad_member
+^samba3.blackbox.smbclient_auth.dot_domain.domain_creds.smbclient.*as.user.*nt4_member
+^samba3.blackbox.smbclient_auth.dot_domain.domain_creds.smbclient.*as.user.*ad_member
+^samba3.blackbox.smbclient_auth.upn.domain_creds.smbclient.*as.*user.*nt4_member
+^samba3.blackbox.smbclient_auth.upn.member_creds.smbclient.*as.*user.*nt4_member
+^samba3.blackbox.smbclient_auth.upn.member_creds.smbclient.*as.*user.*ad_member
diff --git a/selftest/knownfail.d/getncchanges b/selftest/knownfail.d/getncchanges
new file mode 100644
index 0000000..bda9b31
--- /dev/null
+++ b/selftest/knownfail.d/getncchanges
@@ -0,0 +1,8 @@
+# GET_TGT tests currently only work for testenvs that send the links at the
+# same time as the source objects. Currently this is only the vampire_dc
+samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt\(promoted_dc\)
+samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt_chain\(promoted_dc\)
+samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt_and_anc\(promoted_dc\)
+samba4.drs.getncchanges.python\(promoted_dc\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_get_tgt_multivalued_links\(promoted_dc\)
+# Samba chooses to always increment the USN for the NC root at the point where it would otherwise show up.
+samba4.drs.getncchanges.python\(.*\).getncchanges.DrsReplicaSyncIntegrityTestCase.test_repl_nc_is_first_nc_change_only\(
diff --git a/selftest/knownfail.d/gkdi b/selftest/knownfail.d/gkdi
new file mode 100644
index 0000000..fbea302
--- /dev/null
+++ b/selftest/knownfail.d/gkdi
@@ -0,0 +1,19 @@
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_algorithm_none\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_algorithm_sha1\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_algorithm_sha256\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_algorithm_sha384\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_algorithm_sha512\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_before_valid\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_current_l0_idx\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_future_key\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_non_existent_root_key\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_previous_l0_idx\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_root_key_use_start_time_too_low\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_root_key_use_start_time_zero\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiExplicitRootKeyTests\.test_root_key_wrong_length\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiImplicitRootKeyTests\.test_both_seed_keys\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiImplicitRootKeyTests\.test_l1_seed_key\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiImplicitRootKeyTests\.test_l2_seed_key\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiImplicitRootKeyTests\.test_request_default_seed_key\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiImplicitRootKeyTests\.test_request_l0_seed_key\(ad_dc\)$
+^samba\.tests\.krb5\.gkdi_tests\.samba\.tests\.krb5\.gkdi_tests\.GkdiImplicitRootKeyTests\.test_request_l1_seed_key\(ad_dc\)$
diff --git a/selftest/knownfail.d/initshutdown b/selftest/knownfail.d/initshutdown
new file mode 100644
index 0000000..0e8d76a
--- /dev/null
+++ b/selftest/knownfail.d/initshutdown
@@ -0,0 +1,3 @@
+# the initshutdown pipe is not provided by the AD DC
+^samba3.rpc.initshutdown.initshutdown.InitEx\(ad_dc\)
+^samba3.rpc.initshutdown.initshutdown.Init\(ad_dc\)
diff --git a/selftest/knownfail.d/kdc-salt b/selftest/knownfail.d/kdc-salt
new file mode 100644
index 0000000..a671e4d
--- /dev/null
+++ b/selftest/knownfail.d/kdc-salt
@@ -0,0 +1 @@
+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_upn_at_realm_user
diff --git a/selftest/knownfail.d/kinit_trust b/selftest/knownfail.d/kinit_trust
new file mode 100644
index 0000000..c4ac2ca
--- /dev/null
+++ b/selftest/knownfail.d/kinit_trust
@@ -0,0 +1,2 @@
+^samba4.blackbox.kinit_trust.Test login with.*kerberos ccache \(smbclient4\)\(fl2008r2dc:local\)
+^samba4.blackbox.kinit_trust.Test login with.* kerberos ccache \(smbclient4\)\(fl2003dc:local\)
diff --git a/selftest/knownfail.d/krb5-no-preauth b/selftest/knownfail.d/krb5-no-preauth
new file mode 100644
index 0000000..d6f20d0
--- /dev/null
+++ b/selftest/knownfail.d/krb5-no-preauth
@@ -0,0 +1,7 @@
+#
+# MIT and Heimdal currently fails some as_req_no_preauth tests against FL 2003.  It is unclear if we should care.
+#
+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_enc_timestamp_aes128_rc4.*fl2003dc
+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_enc_timestamp_mac_aes128_rc4.*fl2003dc
+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth.*aes.*rc4.*fl2003dc
+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth.*rc4.*aes.*fl2003dc
diff --git a/selftest/knownfail.d/ldap b/selftest/knownfail.d/ldap
new file mode 100644
index 0000000..0331d36
--- /dev/null
+++ b/selftest/knownfail.d/ldap
@@ -0,0 +1,3 @@
+# the attributes too long test returns the wrong error
+^samba4.ldap.python.+test_attribute_ranges_too_long
+samba4.ldap.python\(ad_dc_default\).*__main__.BasicTests.test_ldapSearchNoAttributes
diff --git a/selftest/knownfail.d/ldap_spn b/selftest/knownfail.d/ldap_spn
new file mode 100644
index 0000000..63f9fe0
--- /dev/null
+++ b/selftest/knownfail.d/ldap_spn
@@ -0,0 +1 @@
+samba.tests.ldap_spn.+LdapSpnTest.test_spn_dodgy_spns
diff --git a/selftest/knownfail.d/lm-hash-support-gone b/selftest/knownfail.d/lm-hash-support-gone
new file mode 100644
index 0000000..cced585
--- /dev/null
+++ b/selftest/knownfail.d/lm-hash-support-gone
@@ -0,0 +1,8 @@
+^samba4.blackbox.smbclient .*LANMAN*
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics_lm\(ad_dc:local\)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics_lm\(ad_member:local\)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics_lm\(chgdcpass:local\)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics_lm\(rodc:local\)
+# These fail as they expect no LM support (compared with the _lm test test does)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics\(nt4_dc:local\)
+^samba.tests.ntlm_auth.samba.tests.ntlm_auth.NTLMAuthHelpersTests.test_diagnostics\(nt4_member:local\)
diff --git a/selftest/knownfail.d/modify-order b/selftest/knownfail.d/modify-order
new file mode 100644
index 0000000..76d538e
--- /dev/null
+++ b/selftest/knownfail.d/modify-order
@@ -0,0 +1,8 @@
+samba4.ldap_modify_order.python.+ModifyOrderTests.test_modify_order_account_locality_device
+samba4.ldap_modify_order.python.+ModifyOrderTests.test_modify_order_container_flags_multivalue
+samba4.ldap_modify_order.python.+ModifyOrderTests.test_modify_order_objectclass2
+samba4.ldap_modify_order.python.+ModifyOrderTests.test_modify_order_singlevalue
+samba4.ldap_modify_order.normal_user.+ModifyOrderTests.test_modify_order_account_locality_device
+samba4.ldap_modify_order.normal_user.+ModifyOrderTests.test_modify_order_container_flags[^_]
+samba4.ldap_modify_order.normal_user.+ModifyOrderTests.test_modify_order_objectclass[^2]
+samba4.ldap_modify_order.normal_user.+ModifyOrderTests.test_modify_order_objectclass2
diff --git a/selftest/knownfail.d/multichannel b/selftest/knownfail.d/multichannel
new file mode 100644
index 0000000..6c91b55
--- /dev/null
+++ b/selftest/knownfail.d/multichannel
@@ -0,0 +1,7 @@
+^samba3.smb2.multichannel.oplocks.test2.nt4_dc              # expects windows behavior => smb2 disable oplock break retry = yes
+^samba3.smb2.multichannel.oplocks.test3_windows.nt4_dc      # expects windows behavior => smb2 disable oplock break retry = yes
+^samba3.smb2.multichannel.oplocks.test3_specification.ad_dc # expects samba (MS-SMB2) behavior
+^samba3.smb2.multichannel.leases.test1.ad_dc                # requires lease support
+^samba3.smb2.multichannel.leases.test2.ad_dc                # requires lease support
+^samba3.smb2.multichannel.leases.test3.ad_dc                # requires lease support
+^samba3.smb2.multichannel.leases.test4.ad_dc                # requires lease support
diff --git a/selftest/knownfail.d/netlogon b/selftest/knownfail.d/netlogon
new file mode 100644
index 0000000..b51bf88
--- /dev/null
+++ b/selftest/knownfail.d/netlogon
@@ -0,0 +1,4 @@
+# This test passes against Windows 2008R2, but not Samba as we
+# keep a per-socket cache in addition to the name cache, which is
+# not invalidated if the name-based global cache is used.
+^samba4\.rpc\.netlogon.*\.netlogon\.ServerReqChallengeReuseGlobal3
\ No newline at end of file
diff --git a/selftest/knownfail.d/nt-hash-support-gone b/selftest/knownfail.d/nt-hash-support-gone
new file mode 100644
index 0000000..55ec47d
--- /dev/null
+++ b/selftest/knownfail.d/nt-hash-support-gone
@@ -0,0 +1,9 @@
+^samba4.ldap.login_basics.python.ad_dc_no_ntlm..__main__.BasicUserAuthTests.test_login_basics_ntlm.ad_dc_no_ntlm
+^samba4.ldap.passwords.python.ad_dc_no_ntlm..__main__.PasswordTests.test_old_password_rename_attempt_reuse_2.ad_dc_no_ntlm
+^samba4.ldap.passwords.python.ad_dc_no_ntlm..__main__.PasswordTests.test_old_password_rename_simple_bind_2.ad_dc_no_ntlm
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_attempt_reuse.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_rename_attempt_reuse.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_rename_attempt_reuse_2.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_rename_simple_bind.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_rename_simple_bind_2.fl2003dc
+^samba4.ldap.passwords.python.fl2003dc..__main__.PasswordTests.test_old_password_simple_bind.fl2003dc
diff --git a/selftest/knownfail.d/ntlmv2-restrictions b/selftest/knownfail.d/ntlmv2-restrictions
new file mode 100644
index 0000000..cc67df8
--- /dev/null
+++ b/selftest/knownfail.d/ntlmv2-restrictions
@@ -0,0 +1,2 @@
+# 'raw NTLMv2 auth' is not enabled on ad_member
+^samba4.smb.signing disabled on with -k no --option=clientusespnego=no --client-protection=off domain-creds.xcopy\(ad_member\)
diff --git a/selftest/knownfail.d/oneway b/selftest/knownfail.d/oneway
new file mode 100644
index 0000000..4a182f0
--- /dev/null
+++ b/selftest/knownfail.d/oneway
@@ -0,0 +1,9 @@
+# One way trust, the first one is weird (smbclient4), the rest are logical
+^samba4.blackbox.kinit_trust.Test login with user kerberos ccache \(smbclient4\)\(fl2000dc:local\)
+^samba4.blackbox.kinit_trust.Test user login with the first outgoing secret\(fl2000dc:local\)
+^samba4.blackbox.kinit_trust.Test user login with the changed outgoing secret\(fl2000dc:local\)
+# More one-way trust
+^samba4.blackbox.trust_utils\(fl2000dc:local\).validate trust default both\(fl2000dc:local\)
+^samba4.blackbox.trust_utils\(fl2000dc:local\).validate trust reverse both\(fl2000dc:local\)
+^samba4.blackbox.trust_utils\(fl2000dc:local\).validate trust reverse local\(fl2000dc:local\)
+^samba4.blackbox.trust_utils\(fl2000dc:local\).namespaces own default\(fl2000dc:local\)
diff --git a/selftest/knownfail.d/priv_attr b/selftest/knownfail.d/priv_attr
new file mode 100644
index 0000000..5d3713e
--- /dev/null
+++ b/selftest/knownfail.d/priv_attr
@@ -0,0 +1,13 @@
+# These priv_attrs tests would be good to fix, but are not fatal as
+# the testsuite is run twice, once with and once without STRICT_CHECKING=0
+#
+# These knownfails show that we can improve our error matching against Windows.
+#
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_CC_WP_computer
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_CC_WP_user
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_CC_default_computer
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_CC_default_user
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_admin-add_WP_computer
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_admin-add_WP_user
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_admin-add_default_computer
+samba4.priv_attrs.strict.python\(.*\).__main__.PrivAttrsTests.test_priv_attr_sidHistory_add_admin-add_default_user
diff --git a/selftest/knownfail.d/protected_users b/selftest/knownfail.d/protected_users
new file mode 100644
index 0000000..1ada787
--- /dev/null
+++ b/selftest/knownfail.d/protected_users
@@ -0,0 +1,2 @@
+^samba4.ldap.password_lockout.python\(ad_dc_slowtests\).__main__.PasswordTestsWithoutSleep.test_samr_change_password_protected.ad_dc_slowtests
+^samba4.ldap.password_lockout.python\(ad_dc_slowtests\).__main__.PasswordTestsWithoutSleep.test_samr_set_password_protected.ad_dc_slowtests
diff --git a/selftest/knownfail.d/python-segfaults b/selftest/knownfail.d/python-segfaults
new file mode 100644
index 0000000..d129dab
--- /dev/null
+++ b/selftest/knownfail.d/python-segfaults
@@ -0,0 +1,3 @@
+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3
+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dnsp_string_list
+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dns_record
diff --git a/selftest/knownfail.d/quota1 b/selftest/knownfail.d/quota1
new file mode 100644
index 0000000..a36f325
--- /dev/null
+++ b/selftest/knownfail.d/quota1
@@ -0,0 +1,2 @@
+# ntvfs returns NT_STATUS_NOT_SUPPORTED
+^samba3.smbtorture_s3.plain.SMB2-QUOTA1.smbtorture\(ad_dc_ntvfs\)
diff --git a/selftest/knownfail.d/replica_sync b/selftest/knownfail.d/replica_sync
new file mode 100644
index 0000000..1ef77b0
--- /dev/null
+++ b/selftest/knownfail.d/replica_sync
@@ -0,0 +1,8 @@
+# Samba currently picks a different winner of object conflicts compared to Windows.
+# Samba uses the version number whereas Windows always takes the most recent change
+samba4.drs.replica_sync.python\(vampire_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplConflictsRenamedVsNewRemoteWin\(vampire_dc:local\)
+samba4.drs.replica_sync.python\(promoted_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplConflictsRenamedVsNewRemoteWin\(promoted_dc:local\)
+samba4.drs.replica_sync.python\(vampire_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplConflictsRenamedVsNewLocalWin\(vampire_dc:local\)
+samba4.drs.replica_sync.python\(promoted_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplConflictsRenamedVsNewLocalWin\(promoted_dc:local\)
+samba4.drs.replica_sync.python\(vampire_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplReanimationConflict\(vampire_dc:local\)
+samba4.drs.replica_sync.python\(promoted_dc\).replica_sync.DrsReplicaSyncTestCase.test_ReplReanimationConflict\(promoted_dc:local\)
diff --git a/selftest/knownfail.d/rpc-dfs b/selftest/knownfail.d/rpc-dfs
new file mode 100644
index 0000000..8ab72ff
--- /dev/null
+++ b/selftest/knownfail.d/rpc-dfs
@@ -0,0 +1,2 @@
+#_dfs_EnumEx() is not implemented on RPC server side
+^samba3.blackbox.rpcclient_dfs.dfsenumex
diff --git a/selftest/knownfail.d/rpc-netlogon-zerologon b/selftest/knownfail.d/rpc-netlogon-zerologon
new file mode 100644
index 0000000..29d2e6e
--- /dev/null
+++ b/selftest/knownfail.d/rpc-netlogon-zerologon
@@ -0,0 +1,4 @@
+#
+# Due to differences in the way UTF-16 strings are handled by the source4 and
+# source3 rpc servers, this test fails on the source3 rpc server
+^samba3.rpc.netlogon.zerologon.netlogon.test_SetPassword2_maximum_length_password\(nt4_dc\)
diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid
new file mode 100644
index 0000000..ac5fe57
--- /dev/null
+++ b/selftest/knownfail.d/rw-invalid
@@ -0,0 +1 @@
+samba4.smb2.rw.invalid.ad_dc_ntvfs
diff --git a/selftest/knownfail.d/s3-logging b/selftest/knownfail.d/s3-logging
new file mode 100644
index 0000000..76466dc
--- /dev/null
+++ b/selftest/knownfail.d/s3-logging
@@ -0,0 +1 @@
+samba.tests.logfiles.*S3LoggingTests.test_all_different_ways_cmdline_d\b
diff --git a/selftest/knownfail.d/s3-lsa-server b/selftest/knownfail.d/s3-lsa-server
new file mode 100644
index 0000000..de1244f
--- /dev/null
+++ b/selftest/knownfail.d/s3-lsa-server
@@ -0,0 +1 @@
+^samba4.blackbox.trust_ntlm.Test08.rpcclient.lookupnames.with.ADDOM.SAMBA.EXAMPLE.COM\(ad_member:local\)
diff --git a/selftest/knownfail.d/samba-tool-user-get-kerberos-ticket b/selftest/knownfail.d/samba-tool-user-get-kerberos-ticket
new file mode 100644
index 0000000..db59a9a
--- /dev/null
+++ b/selftest/knownfail.d/samba-tool-user-get-kerberos-ticket
@@ -0,0 +1,5 @@
+# These tests will pass once gMSA support appears
+^samba.tests.samba_tool.user_get_kerberos_ticket.samba.tests.samba_tool.user_get_kerberos_ticket.GetKerberosTiketTest.test_gmsa_ticket.ad_dc:local
+^samba.tests.samba_tool.user_get_kerberos_ticket.samba.tests.samba_tool.user_get_kerberos_ticket.GetKerberosTiketTest.test_gmsa_ticket.ad_dc_no_ntlm:local
+# This test could be fixed by reading the AES keys in supplementalCrednetials, not just the unicodePwd
+^samba.tests.samba_tool.user_get_kerberos_ticket.samba.tests.samba_tool.user_get_kerberos_ticket.GetKerberosTiketTest.test_user_ticket.ad_dc_no_ntlm:local
diff --git a/selftest/knownfail.d/samba3.rpc.samr b/selftest/knownfail.d/samba3.rpc.samr
new file mode 100644
index 0000000..1bcb89e
--- /dev/null
+++ b/selftest/knownfail.d/samba3.rpc.samr
@@ -0,0 +1,5 @@
+# TestPrivateFunctionsDomain is not implemented.
+# QueryDisplayInfo does not return all domain groups on the builtin domain handle.
+^samba3.rpc.samr.samr\(nt4_dc\)
+
+^samba3.rpc.samr.users.samr.users\(nt4_dc\)
diff --git a/selftest/knownfail.d/samba3.vfs.fruit b/selftest/knownfail.d/samba3.vfs.fruit
new file mode 100644
index 0000000..6307e2b
--- /dev/null
+++ b/selftest/knownfail.d/samba3.vfs.fruit
@@ -0,0 +1,2 @@
+^samba3.vfs.fruit streams_depot.OS X AppleDouble file conversion\(nt4_dc\)
+^samba3.vfs.fruit streams_depot.OS X AppleDouble file conversion without embedded xattr\(nt4_dc\)
diff --git a/selftest/knownfail.d/samba4.ldap.confidential_attr b/selftest/knownfail.d/samba4.ldap.confidential_attr
new file mode 100644
index 0000000..46a75ce
--- /dev/null
+++ b/selftest/knownfail.d/samba4.ldap.confidential_attr
@@ -0,0 +1 @@
+^samba4.ldap.confidential_attr.python.*.__main__.*.test_search_with_dirsync_deleted_objects
diff --git a/selftest/knownfail.d/samba4.rpc.netlogon-s3 b/selftest/knownfail.d/samba4.rpc.netlogon-s3
new file mode 100644
index 0000000..a7d6732
--- /dev/null
+++ b/selftest/knownfail.d/samba4.rpc.netlogon-s3
@@ -0,0 +1,4 @@
+# ServerAuthenticate2 returns NT_STATUS_DOWNGRADE_DETECTED, but we expect NT_STATUS_OK
+^samba4.rpc.netlogon-s3\ with\ .netlogon.SetPassword_with_flags\(ad_dc_default\)
+^samba4.rpc.netlogon-s3\ with\ validate.netlogon.SetPassword_with_flags\(ad_dc_default\)
+^samba4.rpc.netlogon-s3\ with\ bigendian.netlogon.SetPassword_with_flags\(ad_dc_default\)
diff --git a/selftest/knownfail.d/samba4.rpc.samr b/selftest/knownfail.d/samba4.rpc.samr
new file mode 100644
index 0000000..5bb04bd
--- /dev/null
+++ b/selftest/knownfail.d/samba4.rpc.samr
@@ -0,0 +1,2 @@
+^samba4.rpc.samr.users\ on\ ncacn_np\ with\ .samr.users\(ad_dc_slowtests\)
+^samba4.rpc.samr.users\ against\ s4member\ server\ with\ local\ creds.samr.users\(s4member\)
diff --git a/selftest/knownfail.d/security-descriptors b/selftest/knownfail.d/security-descriptors
new file mode 100644
index 0000000..3a73e20
--- /dev/null
+++ b/selftest/knownfail.d/security-descriptors
@@ -0,0 +1,4 @@
+^samba.tests.security_descriptors.+SDDLvsDescriptorRegistryObjectRights.+
+^samba.tests.security_descriptors.+SDDLvsDescriptorShortOrdinaryAclsNoMungeV4.+
+
+samba.tests.security_descriptors.+SDDLvsDescriptorOverSizeAcls.+
diff --git a/selftest/knownfail.d/sid-strings b/selftest/knownfail.d/sid-strings
new file mode 100644
index 0000000..c64510e
--- /dev/null
+++ b/selftest/knownfail.d/sid-strings
@@ -0,0 +1,81 @@
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-0-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-0x1-0-0-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-0x1-0x5-020-0243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-0x1-5-20-243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-0x1-5-40-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-0x1-500000000-20-243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-1-0x500000000-0x500000000-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-1-0xABcDef123-0xABCDef123-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-1-5-11111111111111111111111111111111111-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-1-5-18446744073709551615-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-1-5-18446744073709551616-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-1-5-9999999999-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-10-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_S-2-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_internal_S-0-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_internal_S-10-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatSambaPrefers.test_sid_string_internal_S-2-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-0-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-0x1-0-0-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-0x1-0x5-020-0243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-0x1-5-20-243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-0x1-5-40-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-0x1-500000000-20-243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-1-0x500000000-0x500000000-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-1-0xABcDef123-0xABCDef123-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-1-5-11111111111111111111111111111111111-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-1-5-18446744073709551615-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-1-5-18446744073709551616-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-1-5-9999999999-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-10-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_S-2-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-0-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-0x1-0-0-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-0x1-0x5-020-0243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-0x1-5-20-243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-0x1-5-40-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-0x1-500000000-20-243.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-1-0x500000000-0x500000000-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-1-0xABcDef123-0xABCDef123-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-1-5-11111111111111111111111111111111111-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-1-5-18446744073709551615-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-1-5-18446744073709551616-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-1-5-9999999999-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-10-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringBehavioursThatWindowsAllows.test_sid_string_internal_S-2-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringTests.test_sid_string_Aa.ad_dc
+^samba.tests.sid_strings.+.SidStringTests.test_sid_string_aA.ad_dc
+^samba.tests.sid_strings.+.SidStringTests.test_sid_string_aa.ad_dc
+^samba.tests.sid_strings.+.SidStringTests.test_sid_string_internal_Aa.ad_dc
+^samba.tests.sid_strings.+.SidStringTests.test_sid_string_internal_aA.ad_dc
+^samba.tests.sid_strings.+.SidStringTests.test_sid_string_internal_aa.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnInSearchBase.test_sid_string_S-0-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnInSearchBase.test_sid_string_S-1-0x500000000-0x500000000-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnInSearchBase.test_sid_string_S-1-0xABcDef123-0xABCDef123-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnInSearchBase.test_sid_string_S-1-3-0.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnInSearchBase.test_sid_string_S-1-5-3.2-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnInSearchBase.test_sid_string_S-10-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnInSearchBase.test_sid_string_S-2-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnSearchWithDnObject.test_sid_string_S-0-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnSearchWithDnObject.test_sid_string_S-1-0x05-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnSearchWithDnObject.test_sid_string_S-1-0x500000000-0x500000000-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnSearchWithDnObject.test_sid_string_S-1-0xABcDef123-0xABCDef123-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnSearchWithDnObject.test_sid_string_S-1-3-0.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnSearchWithDnObject.test_sid_string_S-1-5-3.2-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnSearchWithDnObject.test_sid_string_S-10-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsAsDnSearchWithDnObject.test_sid_string_S-2-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_.S-1-1-1-1-1-1-1.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-000000000001-5-20-243.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-000000001-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-1-0.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-1-22.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-1-281474976710656-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-1-5-3.2-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-1-5-32--579.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-1-5-32-.579.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-1-5-32.-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_S-1-99999999999999999999999999999999999999-32-11111111111.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_internal_S-000000000001-5-20-243.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_internal_S-000000001-5-32-579.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_internal_S-1-0.ad_dc
+^samba.tests.sid_strings.+.SidStringsThatStartWithS.test_sid_string_internal_S-1-22.ad_dc
diff --git a/selftest/knownfail.d/silo-client-tool b/selftest/knownfail.d/silo-client-tool
new file mode 100644
index 0000000..7b03e5c
--- /dev/null
+++ b/selftest/knownfail.d/silo-client-tool
@@ -0,0 +1,2 @@
+^samba.tests.samba_tool.domain_auth_silo.samba.tests.samba_tool.domain_auth_silo.AuthSiloCmdTestCase.test_delete__protected\(.*\)
+^samba.tests.samba_tool.domain_auth_policy.samba.tests.samba_tool.domain_auth_policy.AuthPolicyCmdTestCase.test_delete__protected\(.*\)
diff --git a/selftest/knownfail.d/smb1-tests b/selftest/knownfail.d/smb1-tests
new file mode 100644
index 0000000..b5263f2
--- /dev/null
+++ b/selftest/knownfail.d/smb1-tests
@@ -0,0 +1,52 @@
+^samba3.blackbox.smbclient_ntlm.plain.*NT1.smbclient username.password.NT1OLD\((ad_member|fl2000dc|nt4_member)\)
+^samba3.blackbox.smbclient_ntlm.plain.*NT1.smbclient username.password.NT1NEW\((ad_member|fl2000dc|nt4_member)\)
+^samba3.blackbox.smbclient_ntlm.plain.*NT1.smbclient anonymous.nopassword.NT1OLD\((ad_member|fl2000dc|nt4_member)\)
+^samba3.blackbox.smbclient_ntlm.plain.*NT1.smbclient anonymous.nopassword.NT1NEW\((ad_member|fl2000dc|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.smbclient -L.*\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.smbclient -L LOCALADMEMBER -I.*\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.noninteractive smbclient does not prompt\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.noninteractive smbclient -l does not prompt\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.interactive smbclient prompts on stdout\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.interactive smbclient -l prompts on stdout\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.creating a bad symlink and deleting it\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Accessing an MS-DFS link\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.del on MS-DFS share\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.deltree on MS-DFS share\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Ensure archive bit is set correctly on file/dir rename\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.ccache access works for smbclient\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.using an authentication file\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.list with backup privilege\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.list a share with bad names \(won't convert\)\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.list a share with a mangled name \+ acl_xattr object\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.server-side file copy\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Ensure widelinks are restricted\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.stream_xattr attributes\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.follow symlinks = no\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.smbclient deltree command\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.server os message\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.test server quiet message\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.setmode test\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.utimes\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.rename_dotdot\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.volume\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.delete a non empty directory\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Recursive ls across MS-DFS links\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Hardlink on MS-DFS share\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.NT1.(plain|sign).member_creds.Rename on MS-DFS share\((ad_member|nt4_member)\)
+^samba3.blackbox.smbclient_s3.*valid.users.nt4.*
+^samba3.blackbox.smbclient_s3.NT1.*valid.users.*
+^samba3.unix.whoami machine account.whoami\(ad_member:local\)
+^samba3.unix.whoami.whoami\(nt4_member\)
+^samba3.unix.whoami anonymous connection.whoami\(nt4_member\)
+^samba3.unix.whoami.whoami\(ad_member\)
+^samba3.unix.whoami kerberos connection.whoami\(ad_member\)
+^samba3.unix.whoami anonymous connection.whoami\(ad_member\)
+^samba3.unix.whoami ntlm user@realm.whoami\(ad_member\)
+^samba4.smb.signing disabled on with -k no --client-protection=off domain-creds.xcopy\(ad_member\)
+^samba4.smb.signing disabled on with -k no --option=gensec:spengo=no --client-protection=off domain-creds.xcopy\(ad_member\)
+^samba4.smb.signing disabled on with -k yes --client-protection=off domain-creds.xcopy\(ad_member\)
+^samba4.blackbox.smbclient\(ad_member:local\).Test login with --machine-pass without kerberos\(ad_member:local\)
+^samba4.blackbox.smbclient\(ad_member:local\).Test login with --machine-pass and kerberos\(ad_member:local\)
+^samba4.blackbox.smbclient\(chgdcpass:local\).Test login with --machine-pass without kerberos\(chgdcpass:local\)
+^samba4.blackbox.smbclient\(chgdcpass:local\).Test login with --machine-pass and kerberos\(chgdcpass:local\)
+^samba3.blackbox.smbclient_basic.NT1.smbclient as NT4SCHANNEL.*\(nt4_dc_schannel\)
diff --git a/selftest/knownfail.d/smb2.replay b/selftest/knownfail.d/smb2.replay
new file mode 100644
index 0000000..4cac807
--- /dev/null
+++ b/selftest/knownfail.d/smb2.replay
@@ -0,0 +1,29 @@
+# These tests demonstrate the broken Windows behavior
+# and check for ACCESS_DENIED instead of FILE_NOT_AVAILABLE
+# See https://bugzilla.samba.org/show_bug.cgi?id=14449
+^samba3.smb2.replay.dhv2-pending1n-vs-violation-lease-close-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1n-vs-violation-lease-ack-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1n-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1n-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1l-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1l-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1o-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1o-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2n-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2n-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2l-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2l-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2o-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending2o-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3n-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3n-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3l-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3l-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3o-vs-oplock-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending3o-vs-lease-windows.nt4_dc
+^samba3.smb2.replay.dhv2-pending1n-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending1o-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending2n-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending2o-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending3n-vs-oplock-windows.ad_dc
+^samba3.smb2.replay.dhv2-pending3o-vs-oplock-windows.ad_dc
diff --git a/selftest/knownfail.d/smb2.session b/selftest/knownfail.d/smb2.session
new file mode 100644
index 0000000..a85fb37
--- /dev/null
+++ b/selftest/knownfail.d/smb2.session
@@ -0,0 +1,4 @@
+# These tests fail with INVALID_PARAMETER as
+# we required the same client guid for session binds
+^samba3.smb2.session.*.bind_negative_smb3signCtoHd
+^samba3.smb2.session.*.bind_negative_smb3signHtoCd
diff --git a/selftest/knownfail.d/smbclient-smb3 b/selftest/knownfail.d/smbclient-smb3
new file mode 100644
index 0000000..119e93e
--- /dev/null
+++ b/selftest/knownfail.d/smbclient-smb3
@@ -0,0 +1,5 @@
+^samba3.blackbox.smbclient_s3.SMB3.*.creating.a.bad.symlink.and.deleting.it
+^samba3.blackbox.acl_xattr.SMB3.nt_affects_posix
+^samba3.blackbox.acl_xattr.SMB3.nt_affects_chown
+^samba3.blackbox.acl_xattr.SMB3.nt_affects_chgrp
+^samba3.blackbox.inherit_owner.*.SMB3.*unix.owner
diff --git a/selftest/knownfail.d/smbclient_machine_auth.plain b/selftest/knownfail.d/smbclient_machine_auth.plain
new file mode 100644
index 0000000..849c8da
--- /dev/null
+++ b/selftest/knownfail.d/smbclient_machine_auth.plain
@@ -0,0 +1,7 @@
+# These envs don't have forceuser/forcegroup shares
+^samba3.blackbox.smbclient_machine_auth.plain.smbclient...addc.forcegroup\(ad_dc:local\)
+^samba3.blackbox.smbclient_machine_auth.plain.smbclient...addc.forceuser\(ad_dc:local\)
+^samba3.blackbox.smbclient_machine_auth.plain.smbclient...dc5.forcegroup\(fl2000dc:local\)
+^samba3.blackbox.smbclient_machine_auth.plain.smbclient...dc5.forceuser\(fl2000dc:local\)
+^samba3.blackbox.smbclient_machine_auth.plain.smbclient...s4member.forcegroup\(s4member:local\)
+^samba3.blackbox.smbclient_machine_auth.plain.smbclient...s4member.forceuser\(s4member:local\)
diff --git a/selftest/knownfail.d/source3-epmapper b/selftest/knownfail.d/source3-epmapper
new file mode 100644
index 0000000..0a731ec
--- /dev/null
+++ b/selftest/knownfail.d/source3-epmapper
@@ -0,0 +1,2 @@
+^samba3.rpc.epmapper\ over\ ncalrpc.epmapper.Map_full\(nt4_dc:local\)
+^samba3.rpc.epmapper\ over\ ncalrpc.epmapper.Insert_noreplace\(nt4_dc:local\)
diff --git a/selftest/knownfail.d/srvsvc b/selftest/knownfail.d/srvsvc
new file mode 100644
index 0000000..63444c8
--- /dev/null
+++ b/selftest/knownfail.d/srvsvc
@@ -0,0 +1,24 @@
+# Except where noted these are missing RPCs with just give a simple
+# fault (mapped to NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareGetInfo\(ad_member\)
+# Level 501 is supported in the s3 srvsrv server
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetTransportEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareEnumAll\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetCharDevQEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetCharDevEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareGetInfo\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareEnum\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareEnumAll\(ad_member\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareGetInfo\(ad_dc\)
+# Level 501 is supported in the s3 srvsrv server
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareEnum\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetTransportEnum\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetShareEnumAll\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetCharDevQEnum\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc \(admin access\).NetCharDevEnum\(ad_dc\)
+# These should be fixed by setting 'restrict anonymous = 2' by default
+# per https://bugzilla.samba.org/show_bug.cgi?id=12775
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareGetInfo\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareEnum\(ad_dc\)
+^samba3.rpc.srvsvc.srvsvc anonymous access.NetShareEnumAll\(ad_dc\)
diff --git a/selftest/knownfail.d/symlink b/selftest/knownfail.d/symlink
new file mode 100644
index 0000000..6413566
--- /dev/null
+++ b/selftest/knownfail.d/symlink
@@ -0,0 +1,4 @@
+^samba.tests.smb2symlink.samba.tests.smb2symlink.Smb2SymlinkTests.test_symlinkerror_directory
+^samba.tests.smb2symlink.samba.tests.smb2symlink.Smb2SymlinkTests.test_symlinkerror_file
+^samba.tests.smb2symlink.samba.tests.smb2symlink.Smb2SymlinkTests.test_symlinkerror_absolute_outside_share
+^samba.tests.smb2symlink.samba.tests.smb2symlink.Smb2SymlinkTests.test_symlinkerror_absolute_inshare
diff --git a/selftest/knownfail.d/uac_objectclass_restrict b/selftest/knownfail.d/uac_objectclass_restrict
new file mode 100644
index 0000000..a9ed5e8
--- /dev/null
+++ b/selftest/knownfail.d/uac_objectclass_restrict
@@ -0,0 +1,17 @@
+# Knownfail entries due to restricting the creation of computer/user
+# accounts (in terms of userAccountControl) that do not match the objectclass
+#
+# All these tests need to be fixed and the entries here removed
+
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-DC_add_CC_WP_user\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-DC_add_CC_default_user\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-a2d-user_add_CC_WP_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-a2d-user_add_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-a2d-user_mod-del-add_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-a2d-user_mod-replace_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-t4d-user_add_CC_WP_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-t4d-user_add_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-t4d-user_mod-del-add_CC_default_computer\(ad_dc_default\)
+^samba4.priv_attrs.strict.python\(ad_dc_default\).__main__.PrivAttrsTests.test_priv_attr_userAccountControl-t4d-user_mod-replace_CC_default_computer\(ad_dc_default\)
+^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_add_computer_sd_cc\(ad_dc_default\)
+^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_mod_computer_cc\(ad_dc_default\)
diff --git a/selftest/knownfail.d/upn_handling b/selftest/knownfail.d/upn_handling
new file mode 100644
index 0000000..bcbedb4
--- /dev/null
+++ b/selftest/knownfail.d/upn_handling
@@ -0,0 +1,8 @@
+^samba3\.wbinfo_user_info\.name_to_sid\.upn\.testdenied_upn.ad_member
+^samba3\.wbinfo_user_info\.user_info\.upn\.testdenied_upn.ad_member
+^samba3\.wbinfo_user_info\.user_info\.domain\.alice.fl2008r2dc
+^samba3\.wbinfo_user_info\.user_info\.upn\.alice.fl2008r2dc
+^samba3\.wbinfo_user_info\.user_info\.domain\.jane.fl2008r2dc
+^samba3\.wbinfo_user_info\.user_info\.upn\.jane\.doe.fl2008r2dc
+^samba3\.wbinfo_user_info\.name_to_sid\.upn\.testdenied_upn.fl2008r2dc
+^samba3\.wbinfo_user_info\.user_info\.upn\.testdenied_upn.fl2008r2dc
diff --git a/selftest/knownfail.d/usage b/selftest/knownfail.d/usage
new file mode 100644
index 0000000..73060e2
--- /dev/null
+++ b/selftest/knownfail.d/usage
@@ -0,0 +1,34 @@
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_claims_py
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_autobuild_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_compare_cc_results_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_config_base.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_ctdb_etcd_lock.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_depfilter_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_dns_hub_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_run_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_run_py_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_smbstatus.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_tests_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_tests_py_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptHelpTests.test_waf.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_claims_py
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_chgtdcpass.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_findprovisionusnranges.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_machineaccountpw.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_rebuildextendeddn.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_renamedc.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_rodcdns.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_gpupdate.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_gpupdate_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_kcc.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_kcc_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_spnupdate.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_spnupdate_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_upgradedns.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_upgradedns_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_upgradeprovision.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_samba_upgradeprovision_.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_smbstatus.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_test_s3_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_test_s4_howto_py.none.
+samba.tests.usage.samba.tests.usage.PythonScriptUsageTests.test_traffic_learner.none.
diff --git a/selftest/knownfail.d/user_getpassword_gmsa b/selftest/knownfail.d/user_getpassword_gmsa
new file mode 100644
index 0000000..4a4fec9
--- /dev/null
+++ b/selftest/knownfail.d/user_getpassword_gmsa
@@ -0,0 +1 @@
+^samba.tests.samba_tool.user_getpassword_gmsa.samba.tests.samba_tool.user_getpassword_gmsa.GMSAPasswordTest
diff --git a/selftest/knownfail.d/vlv b/selftest/knownfail.d/vlv
new file mode 100644
index 0000000..7ae02ba
--- /dev/null
+++ b/selftest/knownfail.d/vlv
@@ -0,0 +1,2 @@
+samba4.ldap.vlv.python.*__main__.VLVTests.test_vlv_change_search_expr
+samba4.ldap.vlv.python.*__main__.PagedResultsTestsRW.test_paged_cant_change_controls_data
diff --git a/selftest/knownfail.d/wkssvc b/selftest/knownfail.d/wkssvc
new file mode 100644
index 0000000..37a0e67
--- /dev/null
+++ b/selftest/knownfail.d/wkssvc
@@ -0,0 +1,25 @@
+# We do not have a full implementation of wkssvc in source3, but we
+# have something worth testing
+samba3.rpc.wkssvc.wkssvc.NetrMessageBufferSend\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrWorkstationStatisticsGet\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrGetJoinableOus2\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrGetJoinableOus\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrGetJoinInformation\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUnjoinDomain\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrJoinDomain\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrEnumerateComputerNames\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrAddAlternateComputerName\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrRemoveAlternateComputerName\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrLogonDomainNameAdd\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrLogonDomainNameDel\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrValidateName2\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrValidateName\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUseAdd\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUseEnum\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUseGetInfo\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrUseDel\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrWkstaUserGetInfo\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrWkstaTransportAdd\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetrWkstaTransportDel\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetWkstaTransportEnum\(ad_member\)
+samba3.rpc.wkssvc.wkssvc.NetWkstaGetInfo\(ad_member\)