selftests: netfilter: avoid test timeouts on debug kernels

Jakub reports that some tests fail on netdev CI when executed in a debug
kernel.

Increase test timeout to 30m, this should hopefully be enough.
Also reduce test duration where possible for "slow" machines.

Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20240429105736.22677-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff --git a/tools/testing/selftests/net/netfilter/br_netfilter.sh b/tools/testing/selftests/net/netfilter/br_netfilter.sh
index d780675..c28379a 100755
--- a/tools/testing/selftests/net/netfilter/br_netfilter.sh
+++ b/tools/testing/selftests/net/netfilter/br_netfilter.sh
@@ -40,7 +40,11 @@
 	fromns="$1"
 	dstip="$2"
 
-	for i in $(seq 1 500); do
+	local packets=500
+
+	[ "$KSFT_MACHINE_SLOW" = yes ] && packets=100
+
+	for i in $(seq 1 $packets); do
 		if ! ip netns exec "$fromns" ping -q -f -b -c 1 -q "$dstip" > /dev/null 2>&1; then
 			echo "ERROR: ping -b from $fromns to $dstip"
 			ip netns exec "$ns0" nft list ruleset
diff --git a/tools/testing/selftests/net/netfilter/nft_nat_zones.sh b/tools/testing/selftests/net/netfilter/nft_nat_zones.sh
index 549f264..3b81d88 100755
--- a/tools/testing/selftests/net/netfilter/nft_nat_zones.sh
+++ b/tools/testing/selftests/net/netfilter/nft_nat_zones.sh
@@ -13,6 +13,7 @@
 have_socat=0
 ret=0
 
+[ "$KSFT_MACHINE_SLOW" = yes ] && maxclients=40
 # client1---.
 #            veth1-.
 #                  |
diff --git a/tools/testing/selftests/net/netfilter/nft_zones_many.sh b/tools/testing/selftests/net/netfilter/nft_zones_many.sh
index 4ad7503..7db9982 100755
--- a/tools/testing/selftests/net/netfilter/nft_zones_many.sh
+++ b/tools/testing/selftests/net/netfilter/nft_zones_many.sh
@@ -6,6 +6,8 @@
 source lib.sh
 
 zones=2000
+[ "$KSFT_MACHINE_SLOW" = yes ] && zones=500
+
 have_ct_tool=0
 ret=0
 
@@ -89,7 +91,7 @@
 		count=$(ip netns exec "$ns1" conntrack -C)
 		duration=$((stop-outerstart))
 
-		if [ "$count" -eq "$max_zones" ]; then
+		if [ "$count" -ge "$max_zones" ]; then
 			echo "PASS: inserted $count entries from packet path in $duration ms total"
 		else
 			ip netns exec "$ns1" conntrack -S 1>&2
diff --git a/tools/testing/selftests/net/netfilter/settings b/tools/testing/selftests/net/netfilter/settings
index 288bd97..abc5648 100644
--- a/tools/testing/selftests/net/netfilter/settings
+++ b/tools/testing/selftests/net/netfilter/settings
@@ -1 +1 @@
-timeout=500
+timeout=1800