Description of problem:
virNWFilterUndefine takes more than 4 minutes to finish for 60 VMs. Each VM has just one interface with 

    <filterref filter='vdsm-no-mac-spoofing'/>

The virNWFilterUndefine triggers modifications to the firewall [1]. One modification per virExec call. This means that virExec is triggered about 1500 times.
One virtExec takes about 0.04 sec, but in the number of calls, it takes a long time.  The entire operation takes 4m34.725s. All delay is spent directly in libvirt.

The same operation takes about 16 sec after the libvirtd restart.


Version-Release number of selected component (if applicable):
libvirt-4.5.0-10.el7_6.2.x86_64

How reproducible:
100% in the affected environment. We were not able to reproduce it a test environment.

Actual results:
The operation takes a long time and stacked products (RHV) are affected by this.

Expected results:
FInish the operation in a reasonable amount of time. In a number of seconds.

Additional info:

[1]:
/usr/sbin/iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet${1} -g FP-vnet${1}
/usr/sbin/iptables -w -D libvirt-out -m physdev --physdev-out vnet${1} -g FP-vnet${1}
/usr/sbin/iptables -w -D libvirt-in -m physdev --physdev-in vnet${1} -g FJ-vnet${1}
/usr/sbin/iptables -w -D libvirt-host-in -m physdev --physdev-in vnet${1} -g HJ-vnet${1}
/usr/sbin/iptables -w -F FP-vnet${1}
/usr/sbin/iptables -w -X FP-vnet${1}
/usr/sbin/iptables -w -F FJ-vnet${1}
/usr/sbin/iptables -w -X FJ-vnet${1}
/usr/sbin/iptables -w -F HJ-vnet${1}
/usr/sbin/iptables -w -X HJ-vnet${1}
/usr/sbin/ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet${1} -g FP-vnet${1}
/usr/sbin/ip6tables -D libvirt-out -m physdev --physdev-out vnet${1} -g FP-vnet${1}
/usr/sbin/ip6tables -D libvirt-in -m physdev --physdev-in vnet${1} -g FJ-vnet${1}
/usr/sbin/ip6tables -D libvirt-host-in -m physdev --physdev-in vnet${1} -g HJ-vnet${1}
/usr/sbin/ip6tables -F FP-vnet${1}
/usr/sbin/ip6tables -X FP-vnet${1}
/usr/sbin/ip6tables -F FJ-vnet${1}
/usr/sbin/ip6tables -X FJ-vnet${1}
/usr/sbin/ip6tables -F HJ-vnet${1}
/usr/sbin/ip6tables -X HJ-vnet${1}
/usr/sbin/ebtables --concurrent -t nat -D PREROUTING -i vnet${1} -j libvirt-J-vnet${1}
/usr/sbin/ebtables --concurrent -t nat -D POSTROUTING -o vnet${1} -j libvirt-P-vnet${1}
/usr/sbin/ebtables --concurrent -t nat -L libvirt-J-vnet${1}
/usr/sbin/ebtables --concurrent -t nat -L libvirt-P-vnet${1}
/usr/sbin/ebtables --concurrent -t nat -F libvirt-J-vnet${1}
/usr/sbin/ebtables --concurrent -t nat -X libvirt-J-vnet${1}
/usr/sbin/ebtables --concurrent -t nat -F libvirt-P-vnet${1}
/usr/sbin/ebtables --concurrent -t nat -X libvirt-P-vnet${1}