merge: branch 'jv/deprecate-mac-blacklist'

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1741

18 files changed, 458 insertions, 117 deletions

diff --git a/src/core/devices/wifi/nm-device-iwd.c b/src/core/devices/wifi/nm-device-iwd.c
index 47407a1e05..89444640f8 100644
--- a/src/core/devices/wifi/nm-device-iwd.c
+++ b/src/core/devices/wifi/nm-device-iwd.c
@@ -774,8 +774,8 @@ check_connection_compatible(NMDevice     *device,
             return FALSE;
         }
 
-        /* Check for MAC address blacklist */
-        mac_blacklist = nm_setting_wireless_get_mac_address_blacklist(s_wireless);
+        /* Check for MAC address denylist */
+        mac_blacklist = nm_setting_wireless_get_mac_address_denylist(s_wireless);
         for (i = 0; mac_blacklist[i]; i++) {
             nm_assert(nm_utils_hwaddr_valid(mac_blacklist[i], ETH_ALEN));
 
diff --git a/src/core/devices/wifi/nm-device-wifi.c b/src/core/devices/wifi/nm-device-wifi.c
index 2cd41b27f3..5f977b47a0 100644
--- a/src/core/devices/wifi/nm-device-wifi.c
+++ b/src/core/devices/wifi/nm-device-wifi.c
@@ -1013,8 +1013,8 @@ check_connection_compatible(NMDevice     *device,
             return FALSE;
         }
 
-        /* Check for MAC address blacklist */
-        mac_blacklist = nm_setting_wireless_get_mac_address_blacklist(s_wireless);
+        /* Check for MAC address denylist */
+        mac_blacklist = nm_setting_wireless_get_mac_address_denylist(s_wireless);
         for (i = 0; mac_blacklist[i]; i++) {
             if (!nm_utils_hwaddr_valid(mac_blacklist[i], ETH_ALEN)) {
                 g_warn_if_reached();
diff --git a/src/libnm-client-impl/libnm.ver b/src/libnm-client-impl/libnm.ver
index 8059aa0dc0..e50676ecbd 100644
--- a/src/libnm-client-impl/libnm.ver
+++ b/src/libnm-client-impl/libnm.ver
@@ -1984,4 +1984,11 @@ global:
 	nm_setting_connection_down_on_poweroff_get_type;
 	nm_setting_connection_get_down_on_poweroff;
 	nm_setting_ip_config_get_dhcp_send_release;
+	nm_setting_wireless_add_mac_denylist_item;
+	nm_setting_wireless_clear_mac_denylist_items;
+	nm_setting_wireless_get_mac_address_denylist;
+	nm_setting_wireless_get_mac_denylist_item;
+	nm_setting_wireless_get_num_mac_denylist_items;
+	nm_setting_wireless_remove_mac_denylist_item;
+	nm_setting_wireless_remove_mac_denylist_item_by_value;
 } libnm_1_46_0;
diff --git a/src/libnm-core-impl/gen-metadata-nm-settings-libnm-core.xml.in b/src/libnm-core-impl/gen-metadata-nm-settings-libnm-core.xml.in
index 97e15bb45b..fb9eb06994 100644
--- a/src/libnm-core-impl/gen-metadata-nm-settings-libnm-core.xml.in
+++ b/src/libnm-core-impl/gen-metadata-nm-settings-libnm-core.xml.in
@@ -103,6 +103,11 @@
                   gprop-type="gchararray"
                   />
         <property name="mac-address-blacklist"
+                  is-deprecated="1"
+                  dbus-type="as"
+                  gprop-type="GStrv"
+                  />
+        <property name="mac-address-denylist"
                   dbus-type="as"
                   gprop-type="GStrv"
                   />
diff --git a/src/libnm-core-impl/nm-setting-connection.c b/src/libnm-core-impl/nm-setting-connection.c
index 44a87720c3..6818645ff3 100644
--- a/src/libnm-core-impl/nm-setting-connection.c
+++ b/src/libnm-core-impl/nm-setting-connection.c
@@ -2751,6 +2751,7 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                             NM_SETTING_CONNECTION_SECONDARIES,
                                             PROP_SECONDARIES,
                                             NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
                                             NMSettingConnectionPrivate,
                                             secondaries);
 
diff --git a/src/libnm-core-impl/nm-setting-match.c b/src/libnm-core-impl/nm-setting-match.c
index 7736b7c0b1..255283fc57 100644
--- a/src/libnm-core-impl/nm-setting-match.c
+++ b/src/libnm-core-impl/nm-setting-match.c
@@ -739,6 +739,7 @@ nm_setting_match_class_init(NMSettingMatchClass *klass)
                                             NM_SETTING_MATCH_INTERFACE_NAME,
                                             PROP_INTERFACE_NAME,
                                             NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
                                             NMSettingMatch,
                                             interface_name);
 
@@ -764,6 +765,7 @@ nm_setting_match_class_init(NMSettingMatchClass *klass)
                                             NM_SETTING_MATCH_KERNEL_COMMAND_LINE,
                                             PROP_KERNEL_COMMAND_LINE,
                                             NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
                                             NMSettingMatch,
                                             kernel_command_line);
 
@@ -783,6 +785,7 @@ nm_setting_match_class_init(NMSettingMatchClass *klass)
                                             NM_SETTING_MATCH_DRIVER,
                                             PROP_DRIVER,
                                             NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
                                             NMSettingMatch,
                                             driver);
 
@@ -824,6 +827,7 @@ nm_setting_match_class_init(NMSettingMatchClass *klass)
                                             NM_SETTING_MATCH_PATH,
                                             PROP_PATH,
                                             NM_SETTING_PARAM_FUZZY_IGNORE,
+                                            NULL,
                                             NMSettingMatch,
                                             path);
 
diff --git a/src/libnm-core-impl/nm-setting-private.h b/src/libnm-core-impl/nm-setting-private.h
index 55bf9efd11..f16bf8dea3 100644
--- a/src/libnm-core-impl/nm-setting-private.h
+++ b/src/libnm-core-impl/nm-setting-private.h
@@ -422,6 +422,13 @@ _nm_setting_connection_autoconnect_ports_to_dbus(_NM_SETT_INFO_PROP_TO_DBUS_FCN_
 gboolean
 _nm_setting_connection_autoconnect_slaves_from_dbus(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS _nm_nil);
 
+gboolean _nm_setting_wireless_mac_denylist_from_dbus(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS _nm_nil);
+
+GVariant *_nm_setting_wireless_mac_denylist_to_dbus(_NM_SETT_INFO_PROP_TO_DBUS_FCN_ARGS _nm_nil);
+
+gboolean
+_nm_setting_wireless_mac_blacklist_from_dbus(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS _nm_nil);
+
 GVariant *_nm_setting_to_dbus(NMSetting                              *setting,
                               NMConnection                           *connection,
                               NMConnectionSerializationFlags          flags,
@@ -869,39 +876,39 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
 
 /*****************************************************************************/
 
-#define _nm_setting_property_define_direct_strv(properties_override,                         \
-                                                obj_properties,                              \
-                                                prop_name,                                   \
-                                                prop_id,                                     \
-                                                param_flags,                                 \
-                                                private_struct_type,                         \
-                                                private_struct_field,                        \
-                                                ... /* extra NMSettInfoProperty fields */)   \
-    G_STMT_START                                                                             \
-    {                                                                                        \
-        GParamSpec *_param_spec;                                                             \
-                                                                                             \
-        G_STATIC_ASSERT(!NM_FLAGS_ANY((param_flags), ~(NM_SETTING_PARAM_FUZZY_IGNORE)));     \
-                                                                                             \
-        _param_spec = g_param_spec_boxed("" prop_name "",                                    \
-                                         "",                                                 \
-                                         "",                                                 \
-                                         G_TYPE_STRV,                                        \
-                                         G_PARAM_READWRITE | G_PARAM_EXPLICIT_NOTIFY         \
-                                             | G_PARAM_STATIC_STRINGS | (param_flags));      \
-                                                                                             \
-        (obj_properties)[(prop_id)] = _param_spec;                                           \
-                                                                                             \
-        _nm_properties_override_gobj((properties_override),                                  \
-                                     _param_spec,                                            \
-                                     &nm_sett_info_propert_type_direct_strv,                 \
-                                     .direct_offset =                                        \
-                                         NM_STRUCT_OFFSET_ENSURE_TYPE(NMValueStrv,           \
-                                                                      private_struct_type,   \
-                                                                      private_struct_field), \
-                                     __VA_ARGS__);                                           \
-    }                                                                                        \
-    G_STMT_END
+#define _nm_setting_property_define_direct_strv(properties_override,                             \
+                                                obj_properties,                                  \
+                                                prop_name,                                       \
+                                                prop_id,                                         \
+                                                param_flags,                                     \
+                                                property_type,                                   \
+                                                private_struct_type,                             \
+                                                private_struct_field,                            \
+                                                ... /* extra NMSettInfoProperty fields */)       \
+    ({                                                                                           \
+        GParamSpec                  *_param_spec;                                                \
+        const NMSettInfoPropertType *_property_type;                                             \
+        G_STATIC_ASSERT(!NM_FLAGS_ANY((param_flags), ~(NM_SETTING_PARAM_FUZZY_IGNORE)));         \
+                                                                                                 \
+        _param_spec = g_param_spec_boxed("" prop_name "",                                        \
+                                         "",                                                     \
+                                         "",                                                     \
+                                         G_TYPE_STRV,                                            \
+                                         G_PARAM_READWRITE | G_PARAM_EXPLICIT_NOTIFY             \
+                                             | G_PARAM_STATIC_STRINGS | (param_flags));          \
+                                                                                                 \
+        (obj_properties)[(prop_id)] = _param_spec;                                               \
+        _property_type              = (property_type) ?: &nm_sett_info_propert_type_direct_strv; \
+                                                                                                 \
+        _nm_properties_override_gobj((properties_override),                                      \
+                                     _param_spec,                                                \
+                                     _property_type,                                             \
+                                     .direct_offset =                                            \
+                                         NM_STRUCT_OFFSET_ENSURE_TYPE(NMValueStrv,               \
+                                                                      private_struct_type,       \
+                                                                      private_struct_field),     \
+                                     __VA_ARGS__);                                               \
+    })
 
 /*****************************************************************************/
 
diff --git a/src/libnm-core-impl/nm-setting-wireless.c b/src/libnm-core-impl/nm-setting-wireless.c
index 93461a99da..1b48261539 100644
--- a/src/libnm-core-impl/nm-setting-wireless.c
+++ b/src/libnm-core-impl/nm-setting-wireless.c
@@ -37,6 +37,7 @@ NM_GOBJECT_PROPERTIES_DEFINE(NMSettingWireless,
                              PROP_CLONED_MAC_ADDRESS,
                              PROP_GENERATE_MAC_ADDRESS_MASK,
                              PROP_MAC_ADDRESS_BLACKLIST,
+                             PROP_MAC_ADDRESS_DENYLIST,
                              PROP_MTU,
                              PROP_SEEN_BSSIDS,
                              PROP_HIDDEN,
@@ -54,7 +55,7 @@ typedef struct {
     char       *device_mac_address;
     char       *cloned_mac_address;
     char       *generate_mac_address_mask;
-    NMValueStrv mac_address_blacklist;
+    NMValueStrv mac_address_denylist;
     int         ap_isolation;
     guint32     mac_address_randomization;
     guint32     channel;
@@ -462,67 +463,73 @@ nm_setting_wireless_get_generate_mac_address_mask(NMSettingWireless *setting)
 }
 
 /**
- * nm_setting_wireless_get_mac_address_blacklist:
+ * nm_setting_wireless_get_mac_address_denylist:
  * @setting: the #NMSettingWireless
  *
- * Returns: the #NMSettingWireless:mac-address-blacklist property of the setting
+ * Returns: the #NMSettingWireless:mac-address-denylist property of the setting
+ *
+ * Since: 1.48
  **/
 const char *const *
-nm_setting_wireless_get_mac_address_blacklist(NMSettingWireless *setting)
+nm_setting_wireless_get_mac_address_denylist(NMSettingWireless *setting)
 {
     g_return_val_if_fail(NM_IS_SETTING_WIRELESS(setting), NULL);
 
     return nm_strvarray_get_strv_notnull(
-        NM_SETTING_WIRELESS_GET_PRIVATE(setting)->mac_address_blacklist.arr,
+        NM_SETTING_WIRELESS_GET_PRIVATE(setting)->mac_address_denylist.arr,
         NULL);
 }
 
 /**
- * nm_setting_wireless_get_num_mac_blacklist_items:
+ * nm_setting_wireless_get_num_mac_denylist_items:
  * @setting: the #NMSettingWireless
  *
- * Returns: the number of blacklisted MAC addresses
+ * Returns: the number of denylisted MAC addresses
+ *
+ * Since: 1.48
  **/
-guint32
-nm_setting_wireless_get_num_mac_blacklist_items(NMSettingWireless *setting)
+guint
+nm_setting_wireless_get_num_mac_denylist_items(NMSettingWireless *setting)
 {
     g_return_val_if_fail(NM_IS_SETTING_WIRELESS(setting), 0);
 
-    return nm_g_array_len(NM_SETTING_WIRELESS_GET_PRIVATE(setting)->mac_address_blacklist.arr);
+    return nm_g_array_len(NM_SETTING_WIRELESS_GET_PRIVATE(setting)->mac_address_denylist.arr);
 }
 
 /**
- * nm_setting_wireless_get_mac_blacklist_item:
+ * nm_setting_wireless_get_mac_denylist_item:
  * @setting: the #NMSettingWireless
  * @idx: the zero-based index of the MAC address entry
  *
- * Since 1.46, access at index "len" is allowed and returns NULL.
- *
- * Returns: the blacklisted MAC address string (hex-digits-and-colons notation)
+ * Returns: the denylisted MAC address string (hex-digits-and-colons notation)
  * at index @idx
+ *
+ * Since: 1.48
  **/
 const char *
-nm_setting_wireless_get_mac_blacklist_item(NMSettingWireless *setting, guint32 idx)
+nm_setting_wireless_get_mac_denylist_item(NMSettingWireless *setting, guint32 idx)
 {
     g_return_val_if_fail(NM_IS_SETTING_WIRELESS(setting), NULL);
 
     return nm_strvarray_get_idxnull_or_greturn(
-        NM_SETTING_WIRELESS_GET_PRIVATE(setting)->mac_address_blacklist.arr,
+        NM_SETTING_WIRELESS_GET_PRIVATE(setting)->mac_address_denylist.arr,
         idx);
 }
 
 /**
- * nm_setting_wireless_add_mac_blacklist_item:
+ * nm_setting_wireless_add_mac_denylist_item:
  * @setting: the #NMSettingWireless
- * @mac: the MAC address string (hex-digits-and-colons notation) to blacklist
+ * @mac: the MAC address string (hex-digits-and-colons notation) to denylist
  *
- * Adds a new MAC address to the #NMSettingWireless:mac-address-blacklist property.
+ * Adds a new MAC address to the #NMSettingWireless:mac-address-denylist property.
  *
  * Returns: %TRUE if the MAC address was added; %FALSE if the MAC address
  * is invalid or was already present
+ *
+ * Since: 1.48
  **/
 gboolean
-nm_setting_wireless_add_mac_blacklist_item(NMSettingWireless *setting, const char *mac)
+nm_setting_wireless_add_mac_denylist_item(NMSettingWireless *setting, const char *mac)
 {
     NMSettingWirelessPrivate *priv;
     guint8                    mac_bin[ETH_ALEN];
@@ -537,57 +544,61 @@ nm_setting_wireless_add_mac_blacklist_item(NMSettingWireless *setting, const cha
         return FALSE;
 
     priv = NM_SETTING_WIRELESS_GET_PRIVATE(setting);
-    len  = nm_g_array_len(priv->mac_address_blacklist.arr);
+    len  = nm_g_array_len(priv->mac_address_denylist.arr);
     for (i = 0; i < len; i++) {
-        candidate = nm_g_array_index(priv->mac_address_blacklist.arr, char *, i);
+        candidate = nm_g_array_index(priv->mac_address_denylist.arr, char *, i);
         if (nm_utils_hwaddr_matches(mac_bin, ETH_ALEN, candidate, -1))
             return FALSE;
     }
 
     mac = nm_utils_hwaddr_canonical(mac, ETH_ALEN);
-    nm_g_array_append_simple(nm_strvarray_ensure(&priv->mac_address_blacklist.arr),
+    nm_g_array_append_simple(nm_strvarray_ensure(&priv->mac_address_denylist.arr),
                              nm_utils_hwaddr_ntoa(mac_bin, ETH_ALEN));
-    _notify(setting, PROP_MAC_ADDRESS_BLACKLIST);
+    _notify(setting, PROP_MAC_ADDRESS_DENYLIST);
     return TRUE;
 }
 
 /**
- * nm_setting_wireless_remove_mac_blacklist_item:
+ * nm_setting_wireless_remove_mac_denylist_item:
  * @setting: the #NMSettingWireless
  * @idx: index number of the MAC address
  *
- * Removes the MAC address at index @idx from the blacklist.
+ * Removes the MAC address at index @idx from the denylist.
+ *
+ * Since: 1.48
  **/
 void
-nm_setting_wireless_remove_mac_blacklist_item(NMSettingWireless *setting, guint32 idx)
+nm_setting_wireless_remove_mac_denylist_item(NMSettingWireless *setting, guint idx)
 {
     NMSettingWirelessPrivate *priv;
 
     g_return_if_fail(NM_IS_SETTING_WIRELESS(setting));
 
     priv = NM_SETTING_WIRELESS_GET_PRIVATE(setting);
-    if (!priv->mac_address_blacklist.arr) {
+    if (!priv->mac_address_denylist.arr) {
         return;
     }
 
-    g_return_if_fail(idx < priv->mac_address_blacklist.arr->len);
+    g_return_if_fail(idx < priv->mac_address_denylist.arr->len);
 
-    g_array_remove_index(priv->mac_address_blacklist.arr, idx);
-    _notify(setting, PROP_MAC_ADDRESS_BLACKLIST);
+    g_array_remove_index(priv->mac_address_denylist.arr, idx);
+    _notify(setting, PROP_MAC_ADDRESS_DENYLIST);
 }
 
 /**
- * nm_setting_wireless_remove_mac_blacklist_item_by_value:
+ * nm_setting_wireless_remove_mac_denylist_item_by_value:
  * @setting: the #NMSettingWireless
  * @mac: the MAC address string (hex-digits-and-colons notation) to remove from
- * the blacklist
+ * the denylist
  *
- * Removes the MAC address @mac from the blacklist.
+ * Removes the MAC address @mac from the denylist.
  *
  * Returns: %TRUE if the MAC address was found and removed; %FALSE if it was not.
+ *
+ * Since: 1.48
  **/
 gboolean
-nm_setting_wireless_remove_mac_blacklist_item_by_value(NMSettingWireless *setting, const char *mac)
+nm_setting_wireless_remove_mac_denylist_item_by_value(NMSettingWireless *setting, const char *mac)
 {
     NMSettingWirelessPrivate *priv;
     guint8                    mac_bin[ETH_ALEN];
@@ -602,12 +613,12 @@ nm_setting_wireless_remove_mac_blacklist_item_by_value(NMSettingWireless *settin
 
     priv = NM_SETTING_WIRELESS_GET_PRIVATE(setting);
 
-    if (priv->mac_address_blacklist.arr) {
-        for (i = 0; i < priv->mac_address_blacklist.arr->len; i++) {
-            candidate = nm_g_array_index(priv->mac_address_blacklist.arr, char *, i);
+    if (priv->mac_address_denylist.arr) {
+        for (i = 0; i < priv->mac_address_denylist.arr->len; i++) {
+            candidate = nm_g_array_index(priv->mac_address_denylist.arr, char *, i);
             if (nm_utils_hwaddr_matches(mac_bin, ETH_ALEN, candidate, -1)) {
-                g_array_remove_index(priv->mac_address_blacklist.arr, i);
-                _notify(setting, PROP_MAC_ADDRESS_BLACKLIST);
+                g_array_remove_index(priv->mac_address_denylist.arr, i);
+                _notify(setting, PROP_MAC_ADDRESS_DENYLIST);
                 return TRUE;
             }
         }
@@ -617,18 +628,131 @@ nm_setting_wireless_remove_mac_blacklist_item_by_value(NMSettingWireless *settin
 }
 
 /**
- * nm_setting_wireless_clear_mac_blacklist_items:
+ * nm_setting_wireless_clear_mac_denylist_items:
  * @setting: the #NMSettingWireless
  *
- * Removes all blacklisted MAC addresses.
+ * Removes all denylisted MAC addresses.
+ *
+ * Since: 1.48
  **/
 void
-nm_setting_wireless_clear_mac_blacklist_items(NMSettingWireless *setting)
+nm_setting_wireless_clear_mac_denylist_items(NMSettingWireless *setting)
 {
     g_return_if_fail(NM_IS_SETTING_WIRELESS(setting));
 
-    if (nm_strvarray_clear(&NM_SETTING_WIRELESS_GET_PRIVATE(setting)->mac_address_blacklist.arr))
-        _notify(setting, PROP_MAC_ADDRESS_BLACKLIST);
+    if (nm_strvarray_clear(&NM_SETTING_WIRELESS_GET_PRIVATE(setting)->mac_address_denylist.arr))
+        _notify(setting, PROP_MAC_ADDRESS_DENYLIST);
+}
+
+/**
+ * nm_setting_wireless_get_mac_address_blacklist:
+ * @setting: the #NMSettingWireless
+ *
+ * Returns: the #NMSettingWireless:mac-address-blacklist property of the setting
+ *
+ * Deprecated: 1.48. Use nm_setting_wireless_get_mac_address_denylist() instead.
+ **/
+const char *const *
+nm_setting_wireless_get_mac_address_blacklist(NMSettingWireless *setting)
+{
+    return nm_setting_wireless_get_mac_address_denylist(setting);
+}
+
+/**
+ * nm_setting_wireless_get_num_mac_blacklist_items:
+ * @setting: the #NMSettingWireless
+ *
+ * Returns: the number of blacklist MAC addresses
+ *
+ * Deprecated: 1.48. Use nm_setting_wireless_get_num_mac_denylist_items() instead.
+ **/
+guint32
+nm_setting_wireless_get_num_mac_blacklist_items(NMSettingWireless *setting)
+{
+    return nm_setting_wireless_get_num_mac_denylist_items(setting);
+}
+
+/**
+ * nm_setting_wireless_get_mac_blacklist_item:
+ * @setting: the #NMSettingWireless
+ * @idx: the zero-based index of the MAC address entry
+ *
+ * Since 1.46, access at index "len" is allowed and returns NULL.
+ *
+ * Returns: the denylisted MAC address string (hex-digits-and-colons notation)
+ * at index @idx
+ *
+ * Deprecated: 1.48. Use nm_setting_wireless_get_mac_denylist_item() instead.
+ **/
+const char *
+nm_setting_wireless_get_mac_blacklist_item(NMSettingWireless *setting, guint32 idx)
+{
+    return nm_setting_wireless_get_mac_denylist_item(setting, idx);
+}
+
+/**
+ * nm_setting_wireless_add_mac_blacklist_item:
+ * @setting: the #NMSettingWireless
+ * @mac: the MAC address string (hex-digits-and-colons notation) to denylist
+ *
+ * Adds a new MAC address to the #NMSettingWireless:mac-address-denylist property.
+ *
+ * Returns: %TRUE if the MAC address was added; %FALSE if the MAC address
+ * is invalid or was already present
+ *
+ * Deprecated: 1.48. Use nm_setting_wireless_add_mac_denylist_item() instead.
+ **/
+gboolean
+nm_setting_wireless_add_mac_blacklist_item(NMSettingWireless *setting, const char *mac)
+{
+    return nm_setting_wireless_add_mac_denylist_item(setting, mac);
+}
+
+/**
+ * nm_setting_wireless_remove_mac_blacklist_item:
+ * @setting: the #NMSettingWireless
+ * @idx: index number of the MAC address
+ *
+ * Removes the MAC address at index @idx from the denylist.
+ *
+ * Deprecated: 1.48. Use nm_setting_wireless_remove_mac_denylist_item() instead.
+ **/
+void
+nm_setting_wireless_remove_mac_blacklist_item(NMSettingWireless *setting, guint32 idx)
+{
+    return nm_setting_wireless_remove_mac_denylist_item(setting, idx);
+}
+
+/**
+ * nm_setting_wireless_remove_mac_blacklist_item_by_value:
+ * @setting: the #NMSettingWireless
+ * @mac: the MAC address string (hex-digits-and-colons notation) to remove from
+ * the denylist
+ *
+ * Removes the MAC address @mac from the denylist.
+ *
+ * Returns: %TRUE if the MAC address was found and removed; %FALSE if it was not.
+ *
+ * Deprecated: 1.48. Use nm_setting_wireless_remove_mac_denylist_item_by_value() instead.
+ **/
+gboolean
+nm_setting_wireless_remove_mac_blacklist_item_by_value(NMSettingWireless *setting, const char *mac)
+{
+    return nm_setting_wireless_remove_mac_denylist_item_by_value(setting, mac);
+}
+
+/**
+ * nm_setting_wireless_clear_mac_blacklist_items:
+ * @setting: the #NMSettingWireless
+ *
+ * Removes all denylisted MAC addresses.
+ *
+ * Deprecated: 1.48. Use nm_setting_wireless_clear_mac_denylist_items() instead.
+ **/
+void
+nm_setting_wireless_clear_mac_blacklist_items(NMSettingWireless *setting)
+{
+    return nm_setting_wireless_clear_mac_denylist_items(setting);
 }
 
 /**
@@ -790,6 +914,61 @@ _to_dbus_fcn_seen_bssids(_NM_SETT_INFO_PROP_TO_DBUS_FCN_ARGS _nm_nil)
     return NULL;
 }
 
+gboolean
+_nm_setting_wireless_mac_blacklist_from_dbus(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS _nm_nil)
+{
+    const gchar **mac_blacklist;
+
+    if (!_nm_setting_use_legacy_property(setting,
+                                         connection_dict,
+                                         NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST,
+                                         NM_SETTING_WIRELESS_MAC_ADDRESS_DENYLIST)) {
+        *out_is_modified = FALSE;
+        return TRUE;
+    }
+    mac_blacklist = g_variant_get_strv(value, NULL);
+
+    g_object_set(setting, NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST, mac_blacklist, NULL);
+    return TRUE;
+}
+
+gboolean
+_nm_setting_wireless_mac_denylist_from_dbus(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS _nm_nil)
+{
+    const gchar **mac_blacklist;
+
+    if (!_nm_setting_use_legacy_property(setting,
+                                         connection_dict,
+                                         NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST,
+                                         NM_SETTING_WIRELESS_MAC_ADDRESS_DENYLIST)) {
+        *out_is_modified = FALSE;
+        return TRUE;
+    }
+    mac_blacklist = g_variant_get_strv(value, NULL);
+
+    g_object_set(setting, NM_SETTING_WIRELESS_MAC_ADDRESS_DENYLIST, mac_blacklist, NULL);
+    return TRUE;
+}
+
+GVariant *
+_nm_setting_wireless_mac_denylist_to_dbus(_NM_SETT_INFO_PROP_TO_DBUS_FCN_ARGS _nm_nil)
+{
+    const char *const *mac_denylist;
+    /* FIXME: `mac-address-denylist` is an alias of `mac-address-blacklist` property.
+     * Serializing the property to the clients would break them as they won't
+     * be able to drop it if they are not aware of the existance of
+     * `mac-address-denylist`. In order to give them time to adapt their code,
+     * NetworkManager is not serializing `mac-address-denylist` on DBus.
+     */
+    if (_nm_utils_is_manager_process) {
+        return NULL;
+    }
+
+    mac_denylist = nm_setting_wireless_get_mac_address_denylist(NM_SETTING_WIRELESS(setting));
+
+    return g_variant_new_strv(mac_denylist, -1);
+}
+
 static gboolean
 _from_dbus_fcn_seen_bssids(_NM_SETT_INFO_PROP_FROM_DBUS_FCN_ARGS _nm_nil)
 {
@@ -1048,9 +1227,9 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
         return FALSE;
     }
 
-    if (priv->mac_address_blacklist.arr) {
-        for (i = 0; i < priv->mac_address_blacklist.arr->len; i++) {
-            const char *mac = nm_g_array_index(priv->mac_address_blacklist.arr, const char *, i);
+    if (priv->mac_address_denylist.arr) {
+        for (i = 0; i < priv->mac_address_denylist.arr->len; i++) {
+            const char *mac = nm_g_array_index(priv->mac_address_denylist.arr, const char *, i);
 
             if (!nm_utils_hwaddr_valid(mac, ETH_ALEN)) {
                 g_set_error(error,
@@ -1061,7 +1240,7 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
                 g_prefix_error(error,
                                "%s.%s: ",
                                NM_SETTING_WIRELESS_SETTING_NAME,
-                               NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST);
+                               NM_SETTING_WIRELESS_MAC_ADDRESS_DENYLIST);
                 return FALSE;
             }
         }
@@ -1339,6 +1518,7 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
     GObjectClass   *object_class        = G_OBJECT_CLASS(klass);
     NMSettingClass *setting_class       = NM_SETTING_CLASS(klass);
     GArray         *properties_override = _nm_sett_info_property_override_create_array_sized(25);
+    guint           prop_idx;
 
     object_class->set_property = set_property;
     object_class->get_property = get_property;
@@ -1712,15 +1892,66 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
      *   is listed.
      * ---end---
      */
-    _nm_setting_property_define_direct_strv(properties_override,
-                                            obj_properties,
-                                            NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST,
-                                            PROP_MAC_ADDRESS_BLACKLIST,
-                                            NM_SETTING_PARAM_FUZZY_IGNORE,
-                                            NMSettingWirelessPrivate,
-                                            mac_address_blacklist,
-                                            .direct_set_strv_normalize_hwaddr = TRUE,
-                                            .direct_strv_not_null             = TRUE);
+    prop_idx = _nm_setting_property_define_direct_strv(
+        properties_override,
+        obj_properties,
+        NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST,
+        PROP_MAC_ADDRESS_BLACKLIST,
+        NM_SETTING_PARAM_FUZZY_IGNORE,
+        NM_SETT_INFO_PROPERT_TYPE_DBUS(G_VARIANT_TYPE_STRING_ARRAY,
+                                       .direct_type = NM_VALUE_TYPE_STRV,
+                                       .compare_fcn = _nm_setting_property_compare_fcn_direct,
+                                       .to_dbus_fcn = _nm_setting_property_to_dbus_fcn_direct,
+                                       .from_dbus_fcn =
+                                           _nm_setting_wireless_mac_blacklist_from_dbus, ),
+        NMSettingWirelessPrivate,
+        mac_address_denylist,
+        .direct_set_strv_normalize_hwaddr = TRUE,
+        .direct_strv_not_null             = TRUE,
+        .direct_is_aliased_field          = TRUE,
+        .is_deprecated                    = TRUE);
+
+    /**
+     * NMSettingWireless:mac-address-denylist:
+     *
+     * A list of permanent MAC addresses of Wi-Fi devices to which this
+     * connection should never apply.  Each MAC address should be given in the
+     * standard hex-digits-and-colons notation (eg "00:11:22:33:44:55").
+     **/
+    /* ---keyfile---
+     * property: mac-address-denylist
+     * format: list of MACs (separated with semicolons)
+     * description: MAC address denylist.
+     * example: mac-address-denylist= 00:22:68:12:79:A6;00:22:68:12:79:78
+     * ---end---
+     */
+    /* ---ifcfg-rh---
+     * property: mac-address-denylist
+     * variable: HWADDR_BLACKLIST(+)
+     * description: It denies usage of the connection for any device whose address
+     *   is listed.
+     * ---end---
+     */
+    _nm_setting_property_define_direct_strv(
+        properties_override,
+        obj_properties,
+        NM_SETTING_WIRELESS_MAC_ADDRESS_DENYLIST,
+        PROP_MAC_ADDRESS_DENYLIST,
+        NM_SETTING_PARAM_FUZZY_IGNORE,
+        NM_SETT_INFO_PROPERT_TYPE_DBUS(G_VARIANT_TYPE_STRING_ARRAY,
+                                       .direct_type = NM_VALUE_TYPE_STRV,
+                                       .compare_fcn = _nm_setting_property_compare_fcn_direct,
+                                       .to_dbus_fcn = _nm_setting_wireless_mac_denylist_to_dbus,
+                                       .from_dbus_fcn =
+                                           _nm_setting_wireless_mac_denylist_from_dbus, ),
+        NMSettingWirelessPrivate,
+        mac_address_denylist,
+        .direct_set_strv_normalize_hwaddr = TRUE,
+        .direct_strv_not_null             = TRUE,
+        .direct_also_notify               = obj_properties[PROP_MAC_ADDRESS_BLACKLIST], );
+
+    nm_g_array_index(properties_override, NMSettInfoProperty, prop_idx).direct_also_notify =
+        obj_properties[PROP_MAC_ADDRESS_DENYLIST];
 
     /**
      * NMSettingWireless:seen-bssids:
diff --git a/src/libnm-core-impl/nm-setting.c b/src/libnm-core-impl/nm-setting.c
index ebd2070ead..70f756b52b 100644
--- a/src/libnm-core-impl/nm-setting.c
+++ b/src/libnm-core-impl/nm-setting.c
@@ -2732,7 +2732,8 @@ _nm_setting_property_compare_fcn_direct(_NM_SETT_INFO_PROP_COMPARE_FCN_ARGS _nm_
                         _nm_setting_property_to_dbus_fcn_direct_mac_address,
                         _nm_setting_connection_controller_to_dbus,
                         _nm_setting_connection_port_type_to_dbus,
-                        _nm_setting_connection_autoconnect_ports_to_dbus));
+                        _nm_setting_connection_autoconnect_ports_to_dbus,
+                        _nm_setting_wireless_mac_denylist_to_dbus));
 
     if (!property_info->param_spec)
         return nm_assert_unreachable_val(NM_TERNARY_DEFAULT);
diff --git a/src/libnm-core-impl/tests/test-setting.c b/src/libnm-core-impl/tests/test-setting.c
index 4b5a0b6f59..142ac0e11d 100644
--- a/src/libnm-core-impl/tests/test-setting.c
+++ b/src/libnm-core-impl/tests/test-setting.c
@@ -4732,8 +4732,9 @@ test_setting_metadata(void)
                 g_assert(sip->param_spec->value_type == G_TYPE_BYTES);
             } else if (sip->property_type->direct_type == NM_VALUE_TYPE_STRV) {
                 g_assert(g_variant_type_equal(sip->property_type->dbus_type, "as"));
-                g_assert(sip->property_type->to_dbus_fcn
-                         == _nm_setting_property_to_dbus_fcn_direct);
+                g_assert(NM_IN_SET(sip->property_type->to_dbus_fcn,
+                                   _nm_setting_property_to_dbus_fcn_direct,
+                                   _nm_setting_wireless_mac_denylist_to_dbus));
                 g_assert(sip->param_spec);
                 g_assert(sip->param_spec->value_type == G_TYPE_STRV);
             } else
diff --git a/src/libnm-core-public/nm-setting-wireless.h b/src/libnm-core-public/nm-setting-wireless.h
index 5f8d09c56c..51060df114 100644
--- a/src/libnm-core-public/nm-setting-wireless.h
+++ b/src/libnm-core-public/nm-setting-wireless.h
@@ -84,6 +84,7 @@ typedef enum /*< flags >*/ {
 #define NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS        "cloned-mac-address"
 #define NM_SETTING_WIRELESS_GENERATE_MAC_ADDRESS_MASK "generate-mac-address-mask"
 #define NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST     "mac-address-blacklist"
+#define NM_SETTING_WIRELESS_MAC_ADDRESS_DENYLIST      "mac-address-denylist"
 #define NM_SETTING_WIRELESS_MTU                       "mtu"
 #define NM_SETTING_WIRELESS_SEEN_BSSIDS               "seen-bssids"
 #define NM_SETTING_WIRELESS_HIDDEN                    "hidden"
@@ -168,14 +169,30 @@ const char *nm_setting_wireless_get_cloned_mac_address(NMSettingWireless *settin
 NM_AVAILABLE_IN_1_4
 const char *nm_setting_wireless_get_generate_mac_address_mask(NMSettingWireless *setting);
 
+_NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_48
 const char *const *nm_setting_wireless_get_mac_address_blacklist(NMSettingWireless *setting);
-guint32            nm_setting_wireless_get_num_mac_blacklist_items(NMSettingWireless *setting);
+_NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_48
+guint32 nm_setting_wireless_get_num_mac_blacklist_items(NMSettingWireless *setting);
+_NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_48
 const char *nm_setting_wireless_get_mac_blacklist_item(NMSettingWireless *setting, guint32 idx);
-gboolean    nm_setting_wireless_add_mac_blacklist_item(NMSettingWireless *setting, const char *mac);
-void        nm_setting_wireless_remove_mac_blacklist_item(NMSettingWireless *setting, guint32 idx);
-gboolean    nm_setting_wireless_remove_mac_blacklist_item_by_value(NMSettingWireless *setting,
-                                                                   const char        *mac);
-void        nm_setting_wireless_clear_mac_blacklist_items(NMSettingWireless *setting);
+_NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_48
+gboolean nm_setting_wireless_add_mac_blacklist_item(NMSettingWireless *setting, const char *mac);
+_NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_48
+void nm_setting_wireless_remove_mac_blacklist_item(NMSettingWireless *setting, guint32 idx);
+_NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_48
+gboolean nm_setting_wireless_remove_mac_blacklist_item_by_value(
+    NMSettingWireless                                 *setting,
+    _NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_48 const char *mac);
+void nm_setting_wireless_clear_mac_blacklist_items(NMSettingWireless *setting);
+
+const char *const *nm_setting_wireless_get_mac_address_denylist(NMSettingWireless *setting);
+guint32            nm_setting_wireless_get_num_mac_denylist_items(NMSettingWireless *setting);
+const char *nm_setting_wireless_get_mac_denylist_item(NMSettingWireless *setting, guint32 idx);
+gboolean    nm_setting_wireless_add_mac_denylist_item(NMSettingWireless *setting, const char *mac);
+void        nm_setting_wireless_remove_mac_denylist_item(NMSettingWireless *setting, guint32 idx);
+gboolean    nm_setting_wireless_remove_mac_denylist_item_by_value(NMSettingWireless *setting,
+                                                                  const char        *mac);
+void        nm_setting_wireless_clear_mac_denylist_items(NMSettingWireless *setting);
 
 guint32  nm_setting_wireless_get_mtu(NMSettingWireless *setting);
 gboolean nm_setting_wireless_get_hidden(NMSettingWireless *setting);
diff --git a/src/libnm-core-public/nm-version.h b/src/libnm-core-public/nm-version.h
index 419da2e1f7..2680a439b4 100644
--- a/src/libnm-core-public/nm-version.h
+++ b/src/libnm-core-public/nm-version.h
@@ -424,5 +424,6 @@
 #define _NM_DEPRECATED_SYNC_METHOD             NM_DEPRECATED_IN_1_24
 #define _NM_DEPRECATED_SYNC_WRITABLE_PROPERTY  /* NM_DEPRECATED_IN_1_22 */
 #define _NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_44 /* NM_DEPRECATED_IN_1_44 */
+#define _NM_DEPRECATED_INCLUSIVE_LANGUAGE_1_48 /* NM_DEPRECATED_IN_1_48 */
 
 #endif /* NM_VERSION_H */
diff --git a/src/libnmc-setting/nm-meta-setting-desc.c b/src/libnmc-setting/nm-meta-setting-desc.c
index 86070d3146..8335a4f9c6 100644
--- a/src/libnmc-setting/nm-meta-setting-desc.c
+++ b/src/libnmc-setting/nm-meta-setting-desc.c
@@ -8237,12 +8237,27 @@ static const NMMetaPropertyInfo *const property_infos_WIRELESS[] = {
     ),
     PROPERTY_INFO_WITH_DESC (NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST,
         .property_type =                &_pt_multilist,
+        .hide_if_default =              TRUE,
+        .property_typ_data = DEFINE_PROPERTY_TYP_DATA (
+            PROPERTY_TYP_DATA_SUBTYPE (multilist,
+                .get_num_fcn_u32 =       MULTILIST_GET_NUM_FCN_U32     (NMSettingWireless, nm_setting_wireless_get_num_mac_denylist_items),
+                .add_fcn =               MULTILIST_ADD_FCN             (NMSettingWireless, nm_setting_wireless_add_mac_denylist_item),
+                .remove_by_idx_fcn_u32 = MULTILIST_REMOVE_BY_IDX_FCN_U32 (NMSettingWireless, nm_setting_wireless_remove_mac_denylist_item),
+                .remove_by_value_fcn =   MULTILIST_REMOVE_BY_VALUE_FCN (NMSettingWireless, nm_setting_wireless_remove_mac_denylist_item_by_value),
+                .validate2_fcn =        _multilist_validate2_fcn_mac_addr,
+                .strsplit_plain =       TRUE,
+            ),
+            .list_items_doc_format =    NM_META_PROPERTY_TYPE_FORMAT_MAC,
+        ),
+    ),
+    PROPERTY_INFO_WITH_DESC (NM_SETTING_WIRELESS_MAC_ADDRESS_DENYLIST,
+        .property_type =                &_pt_multilist,
         .property_typ_data = DEFINE_PROPERTY_TYP_DATA (
             PROPERTY_TYP_DATA_SUBTYPE (multilist,
-                .get_num_fcn_u32 =      MULTILIST_GET_NUM_FCN_U32     (NMSettingWireless, nm_setting_wireless_get_num_mac_blacklist_items),
-                .add_fcn =              MULTILIST_ADD_FCN             (NMSettingWireless, nm_setting_wireless_add_mac_blacklist_item),
-                .remove_by_idx_fcn_u32 = MULTILIST_REMOVE_BY_IDX_FCN_U32 (NMSettingWireless, nm_setting_wireless_remove_mac_blacklist_item),
-                .remove_by_value_fcn =  MULTILIST_REMOVE_BY_VALUE_FCN (NMSettingWireless, nm_setting_wireless_remove_mac_blacklist_item_by_value),
+                .get_num_fcn_u =        MULTILIST_GET_NUM_FCN_U       (NMSettingWireless, nm_setting_wireless_get_num_mac_denylist_items),
+                .add_fcn =              MULTILIST_ADD_FCN             (NMSettingWireless, nm_setting_wireless_add_mac_denylist_item),
+                .remove_by_idx_fcn_u =  MULTILIST_REMOVE_BY_IDX_FCN_U (NMSettingWireless, nm_setting_wireless_remove_mac_denylist_item),
+                .remove_by_value_fcn =  MULTILIST_REMOVE_BY_VALUE_FCN (NMSettingWireless, nm_setting_wireless_remove_mac_denylist_item_by_value),
                 .validate2_fcn =        _multilist_validate2_fcn_mac_addr,
                 .strsplit_plain =       TRUE,
             ),
diff --git a/src/libnmc-setting/settings-docs.h.in b/src/libnmc-setting/settings-docs.h.in
index a9aa3cf412..2dd3d55487 100644
--- a/src/libnmc-setting/settings-docs.h.in
+++ b/src/libnmc-setting/settings-docs.h.in
@@ -418,6 +418,7 @@
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_HIDDEN N_("If TRUE, indicates that the network is a non-broadcasting network that hides its SSID. This works both in infrastructure and AP mode. In infrastructure mode, various workarounds are used for a more reliable discovery of hidden networks, such as probe-scanning the SSID.  However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution. In AP mode, the created network does not broadcast its SSID. Note that marking the network as hidden may be a privacy issue for you (in infrastructure mode) or client stations (in AP mode), as the explicit probe-scans are distinctly recognizable on the air.")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_MAC_ADDRESS N_("If specified, this connection will only apply to the Wi-Fi device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST N_("A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg \"00:11:22:33:44:55\").")
+#define DESCRIBE_DOC_NM_SETTING_WIRELESS_MAC_ADDRESS_DENYLIST N_("A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg \"00:11:22:33:44:55\").")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_MAC_ADDRESS_RANDOMIZATION N_("One of \"default\" (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization),  \"never\" (1) (never randomize the MAC address), or \"always\" (2) (always randomize the MAC address).")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_MODE N_("Wi-Fi network mode; one of \"infrastructure\", \"mesh\", \"adhoc\" or \"ap\".  If blank, infrastructure is assumed.")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_MTU N_("If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.")
diff --git a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
index 3c3d1c44cb..3428b886a3 100644
--- a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
+++ b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
@@ -58,6 +58,9 @@
         <property name="mac-address-blacklist"
                   nmcli-description="A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg &quot;00:11:22:33:44:55&quot;)."
                   format="list of MAC addresses" />
+        <property name="mac-address-denylist"
+                  nmcli-description="A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg &quot;00:11:22:33:44:55&quot;)."
+                  format="list of MAC addresses" />
         <property name="mac-address-randomization"
                   nmcli-description="One of &quot;default&quot; (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization),  &quot;never&quot; (1) (never randomize the MAC address), or &quot;always&quot; (2) (always randomize the MAC address)."
                   format="choice (NMSettingMacRandomization)"
diff --git a/src/tests/client/test-client.check-on-disk/test_004.expected b/src/tests/client/test-client.check-on-disk/test_004.expected
index 9c4d7f93b3..688bbde94a 100644
--- a/src/tests/client/test-client.check-on-disk/test_004.expected
+++ b/src/tests/client/test-client.check-on-disk/test_004.expected
@@ -48,9 +48,9 @@ stderr: 116 bytes
 Error: invalid or not allowed setting '802': '802' is ambiguous: 802-11-wireless, 802-11-wireless-security, 802-1x.
 
 <<<
-size: 135
+size: 189
 location: src/tests/client/test-client.py:test_004()/6
-cmd: $NMCLI connection mod con-xx1 802-11-wireless.band a
+cmd: $NMCLI connection mod con-xx1 802-11-wireless.band a 802-11-wireless.mac-address-denylist aA:Bb:cC:dd:EE:f
 lang: C
 returncode: 0
 size: 241
@@ -58,12 +58,12 @@ location: src/tests/client/test-client.py:test_004()/7
 cmd: $NMCLI connection mod con-xx1 ipv4.addresses 192.168.77.5/24 ipv4.routes '2.3.4.5/32 192.168.77.1' ipv6.addresses 1:2:3:4::6/64 ipv6.routes 1:2:3:4:5:6::5/128
 lang: C
 returncode: 0
-size: 5421
+size: 5494
 location: src/tests/client/test-client.py:test_004()/8
 cmd: $NMCLI con s con-xx1
 lang: C
 returncode: 0
-stdout: 5290 bytes
+stdout: 5363 bytes
 >>>
 connection.id:                          con-xx1
 connection.uuid:                        UUID-con-xx1-REPLACED-REPLACED-REPLA
@@ -103,7 +103,8 @@ connection.wait-activation-delay:       -1
 802-11-wireless.mac-address:            --
 802-11-wireless.cloned-mac-address:     --
 802-11-wireless.generate-mac-address-mask:--
-802-11-wireless.mac-address-blacklist:  --
+802-11-wireless.mac-address-blacklist:  AA:BB:CC:DD:EE:0F
+802-11-wireless.mac-address-denylist:   AA:BB:CC:DD:EE:0F
 802-11-wireless.mac-address-randomization:default
 802-11-wireless.mtu:                    auto
 802-11-wireless.seen-bssids:            --
@@ -179,12 +180,12 @@ proxy.pac-url:                          --
 proxy.pac-script:                       --
 
 <<<
-size: 5456
+size: 5529
 location: src/tests/client/test-client.py:test_004()/9
 cmd: $NMCLI con s con-xx1
 lang: pl_PL.UTF-8
 returncode: 0
-stdout: 5315 bytes
+stdout: 5388 bytes
 >>>
 connection.id:                          con-xx1
 connection.uuid:                        UUID-con-xx1-REPLACED-REPLACED-REPLA
@@ -224,7 +225,8 @@ connection.wait-activation-delay:       -1
 802-11-wireless.mac-address:            --
 802-11-wireless.cloned-mac-address:     --
 802-11-wireless.generate-mac-address-mask:--
-802-11-wireless.mac-address-blacklist:  --
+802-11-wireless.mac-address-blacklist:  AA:BB:CC:DD:EE:0F
+802-11-wireless.mac-address-denylist:   AA:BB:CC:DD:EE:0F
 802-11-wireless.mac-address-randomization:default
 802-11-wireless.mtu:                    automatyczne
 802-11-wireless.seen-bssids:            --
diff --git a/src/tests/client/test-client.py b/src/tests/client/test-client.py
index df137ee0f0..60853e6d52 100755
--- a/src/tests/client/test-client.py
+++ b/src/tests/client/test-client.py
@@ -1810,7 +1810,17 @@ class TestNmcli(unittest.TestCase):
         )
         self.call_nmcli(["connection", "mod", "con-xx1", "ipv6.gateway", "::99"])
         self.call_nmcli(["connection", "mod", "con-xx1", "802.abc", ""])
-        self.call_nmcli(["connection", "mod", "con-xx1", "802-11-wireless.band", "a"])
+        self.call_nmcli(
+            [
+                "connection",
+                "mod",
+                "con-xx1",
+                "802-11-wireless.band",
+                "a",
+                "802-11-wireless.mac-address-denylist",
+                "aA:Bb:cC:dd:EE:f",
+            ]
+        )
         self.call_nmcli(
             [
                 "connection",
diff --git a/tools/test-networkmanager-service.py b/tools/test-networkmanager-service.py
index 80e7a0012b..957f076f3a 100755
--- a/tools/test-networkmanager-service.py
+++ b/tools/test-networkmanager-service.py
@@ -31,6 +31,34 @@ _DEFAULT_ARG = object()
 ###############################################################################
 
 
+class AliasedProperty:
+    def __init__(self, old_name, new_name):
+        self.old_name = old_name
+        self.new_name = new_name
+
+
+ALIASED_PROPERTIES = {
+    NM.SETTING_CONNECTION_SETTING_NAME: [
+        AliasedProperty(
+            NM.SETTING_CONNECTION_MASTER,
+            "controller",  # NM.SETTING_CONNECTION_CONTROLLER
+        ),
+        AliasedProperty(
+            NM.SETTING_CONNECTION_SLAVE_TYPE,
+            "port-type",  # NM.SETTING_CONNECTION_PORT_TYPE
+        ),
+        AliasedProperty(NM.SETTING_CONNECTION_AUTOCONNECT_SLAVES, "autoconnect-ports"),
+    ],
+    NM.SETTING_WIRELESS_SETTING_NAME: [
+        AliasedProperty(
+            NM.SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST, "mac-address-denylist"
+        )
+    ],
+}
+
+###############################################################################
+
+
 class Global:
     pass
 
@@ -2118,6 +2146,13 @@ class Connection(ExportedObj):
         out_signature="a{sv}",
     )
     def Update2(self, con_hash, flags, args):
+        for setting_name in ALIASED_PROPERTIES.keys():
+            if setting_name in con_hash:
+                setting = con_hash[setting_name]
+                for pty in ALIASED_PROPERTIES[setting_name]:
+                    if pty.new_name in setting and pty.old_name in setting:
+                        del setting[pty.new_name]
+
         self.update_connection(con_hash, True)
         return []