libnm-core: change connection hash tables to variants in API

In preparation for porting to GDBus, make nm_connection_to_dbus(),
etc, represent connections as GVariants of type 'a{sa{sv}}' rather
than as GHashTables-of-GHashTables-of-GValues.

This means we're constantly converting back and forth internally, but
this is just a stepping stone on the way to the full GDBus port, and
all of that code will go away again later.

57 files changed, 1333 insertions, 2205 deletions

diff --git a/callouts/nm-dispatcher-utils.c b/callouts/nm-dispatcher-utils.c
index 9a16880a57..66b6a07fd8 100644
--- a/callouts/nm-dispatcher-utils.c
+++ b/callouts/nm-dispatcher-utils.c
@@ -406,7 +406,7 @@ nm_dispatcher_utils_construct_envp (const char *action,
 	}
 
 	/* UUID and ID */
-	con_setting = g_variant_lookup_value (connection_dict, NM_SETTING_CONNECTION_SETTING_NAME, G_VARIANT_TYPE ("a{sv}"));
+	con_setting = g_variant_lookup_value (connection_dict, NM_SETTING_CONNECTION_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
 	if (!con_setting) {
 		g_warning ("Failed to read connection setting");
 		return NULL;
diff --git a/callouts/tests/test-dispatcher-envp.c b/callouts/tests/test-dispatcher-envp.c
index b51c1c16a5..c2f1b41df7 100644
--- a/callouts/tests/test-dispatcher-envp.c
+++ b/callouts/tests/test-dispatcher-envp.c
@@ -30,25 +30,9 @@
 #include "nm-dispatcher-utils.h"
 #include "nm-dispatcher-api.h"
 #include "nm-utils.h"
-#include "nm-dbus-glib-types.h"
 
 /*******************************************/
 
-static GVariant *
-connection_hash_to_dict (GHashTable *hash)
-{
-	GValue val = { 0, };
-	GVariant *dict;
-
-	g_value_init (&val, DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT);
-	g_value_set_boxed (&val, hash);
-	dict = dbus_g_value_build_g_variant (&val);
-	g_value_unset (&val);
-
-	g_variant_ref_sink (dict);
-	return dict;
-}
-
 static gboolean
 parse_main (GKeyFile *kf,
             GVariant **out_con_dict,
@@ -62,7 +46,6 @@ parse_main (GKeyFile *kf,
 	NMConnection *connection;
 	NMSettingConnection *s_con;
 	GVariantBuilder props;
-	GHashTable *con_hash;
 
 	*out_expected_iface = g_key_file_get_string (kf, "main", "expected-iface", error);
 	if (*out_expected_iface == NULL)
@@ -93,10 +76,8 @@ parse_main (GKeyFile *kf,
 	g_free (id);
 	nm_connection_add_setting (connection, NM_SETTING (s_con));
 
-	con_hash = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	*out_con_dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
 	g_object_unref (connection);
-	*out_con_dict = connection_hash_to_dict (con_hash);
-	g_hash_table_unref (con_hash);
 
 	g_variant_builder_init (&props, G_VARIANT_TYPE ("a{sv}"));
 	g_variant_builder_add (&props, "{sv}",
diff --git a/clients/cli/connections.c b/clients/cli/connections.c
index 89ff12b7fd..bd425ecfd6 100644
--- a/clients/cli/connections.c
+++ b/clients/cli/connections.c
@@ -5343,19 +5343,19 @@ gen_cmd_print0 (const char *text, int state)
 	char *ret = NULL;
 
 	if (!state) {
-		GHashTable *settings;
-		GHashTableIter iter;
+		GVariant *settings;
+		GVariantIter iter;
 		const char *setting_name;
 		int i = 0;
 
 		settings = nm_connection_to_dbus (nmc_tab_completion.connection, NM_CONNECTION_SERIALIZE_NO_SECRETS);
-		words = g_new (char *, g_hash_table_size (settings) + 2);
-		g_hash_table_iter_init (&iter, settings);
-		while (g_hash_table_iter_next (&iter, (gpointer) &setting_name, NULL))
+		words = g_new (char *, g_variant_n_children (settings) + 2);
+		g_variant_iter_init (&iter, settings);
+		while (g_variant_iter_next (&iter, "{&s@a{sv}}", &setting_name, NULL))
 			words [i++] = g_strdup (setting_name);
 		words[i++] = g_strdup ("all");
 		words[i] = NULL;
-		g_hash_table_unref (settings);
+		g_variant_unref (settings);
 	}
 
 	if (words) {
diff --git a/clients/tui/nmt-editor.c b/clients/tui/nmt-editor.c
index ab364f4b3f..0f35f48f04 100644
--- a/clients/tui/nmt-editor.c
+++ b/clients/tui/nmt-editor.c
@@ -162,31 +162,21 @@ save_connection_and_exit (NmtNewtButton *button,
 
 static void
 got_secrets (NMRemoteConnection *connection,
-             GHashTable         *secrets,
+             GVariant           *secrets,
              GError             *error,
              gpointer            op)
 {
-	GHashTable *copy = NULL, *setting;
-	GHashTableIter iter;
-	const char *name;
-
-	if (secrets) {
-		/* 'secrets' is owned by the caller so we must copy it */
-		copy = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, (GDestroyNotify) g_hash_table_destroy);
-		g_hash_table_iter_init (&iter, secrets);
-		while (g_hash_table_iter_next (&iter, (gpointer) &name, (gpointer) &setting))
-			g_hash_table_insert (copy, g_strdup (name), nm_utils_gvalue_hash_dup (setting));
-	}
-
-	nmt_sync_op_complete_pointer (op, copy, error);
+	if (secrets)
+		g_variant_ref (secrets);
+	nmt_sync_op_complete_pointer (op, secrets, error);
 }
 
 static NMConnection *
 build_edit_connection (NMConnection *orig_connection)
 {
 	NMConnection *edit_connection;
-	GHashTable *settings, *secrets;
-	GHashTableIter iter;
+	GVariant *settings, *secrets;
+	GVariantIter iter;
 	const char *setting_name;
 	NmtSyncOp op;
 
@@ -196,8 +186,8 @@ build_edit_connection (NMConnection *orig_connection)
 		return edit_connection;
 
 	settings = nm_connection_to_dbus (orig_connection, NM_CONNECTION_SERIALIZE_NO_SECRETS);
-	g_hash_table_iter_init (&iter, settings);
-	while (g_hash_table_iter_next (&iter, (gpointer) &setting_name, NULL)) {
+	g_variant_iter_init (&iter, settings);
+	while (g_variant_iter_next (&iter, "{&s@a{sv}}", &setting_name, NULL)) {
 		nmt_sync_op_init (&op);
 		nm_remote_connection_get_secrets (NM_REMOTE_CONNECTION (orig_connection),
 		                                  setting_name, got_secrets, &op);
@@ -205,10 +195,10 @@ build_edit_connection (NMConnection *orig_connection)
 		secrets = nmt_sync_op_wait_pointer (&op, NULL);
 		if (secrets) {
 			(void) nm_connection_update_secrets (edit_connection, setting_name, secrets, NULL);
-			g_hash_table_unref (secrets);
+			g_variant_unref (secrets);
 		}
 	}
-	g_hash_table_unref (settings);
+	g_variant_unref (settings);
 
 	return edit_connection;
 }
diff --git a/clients/tui/nmt-secret-agent.c b/clients/tui/nmt-secret-agent.c
index 7550ce64f6..b2c7ad890c 100644
--- a/clients/tui/nmt-secret-agent.c
+++ b/clients/tui/nmt-secret-agent.c
@@ -482,14 +482,6 @@ nmt_secret_agent_get_secrets (NMSecretAgent                 *agent,
 	request_secrets_from_ui (request);
 }
 
-static void
-gvalue_destroy_notify (gpointer data)
-{
-	GValue *value = data;
-	g_value_unset (value);
-	g_slice_free (GValue, value);
-}
-
 /**
  * nmt_secret_agent_response:
  * @self: the #NmtSecretAgent
@@ -511,8 +503,7 @@ nmt_secret_agent_response (NmtSecretAgent *self,
 {
 	NmtSecretAgentPrivate *priv;
 	NmtSecretAgentRequest *request;
-	GHashTable *hash = NULL, *setting_hash;
-	GValue *value;
+	GVariant *dict = NULL;
 	GError *error = NULL;
 	int i;
 
@@ -523,32 +514,41 @@ nmt_secret_agent_response (NmtSecretAgent *self,
 	g_return_if_fail (request != NULL);
 
 	if (secrets) {
-		hash = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, (GDestroyNotify) g_hash_table_unref);
+		GVariantBuilder conn_builder, *setting_builder;
+		GHashTable *settings;
+		GHashTableIter iter;
+		const char *name;
+
+		settings = g_hash_table_new (g_str_hash, g_str_equal);
 		for (i = 0; i < secrets->len; i++) {
 			NmtSecretAgentSecretReal *secret = secrets->pdata[i];
 
-			setting_hash = g_hash_table_lookup (hash, nm_setting_get_name (secret->setting));
-			if (!setting_hash) {
-				setting_hash = g_hash_table_new_full (g_str_hash, g_str_equal,
-				                                      g_free, gvalue_destroy_notify);
-				g_hash_table_insert (hash, (char *)nm_setting_get_name (secret->setting),
-				                     setting_hash);
+			setting_builder = g_hash_table_lookup (settings, nm_setting_get_name (secret->setting));
+			if (!setting_builder) {
+				setting_builder = g_variant_builder_new (NM_VARIANT_TYPE_SETTING);
+				g_hash_table_insert (settings, (char *) nm_setting_get_name (secret->setting),
+				                     setting_builder);
 			}
 
-			value = g_slice_new0 (GValue);
-			g_value_init (value, G_TYPE_STRING);
-			g_value_set_string (value, secret->base.value);
-
-			g_hash_table_insert (setting_hash, g_strdup (secret->property), value);
+			g_variant_builder_add (setting_builder, "{sv}",
+			                       secret->property,
+			                       g_variant_new_string (secret->base.value));
 		}
+
+		g_variant_builder_init (&conn_builder, NM_VARIANT_TYPE_CONNECTION);
+		g_hash_table_iter_init (&iter, settings);
+		while (g_hash_table_iter_next (&iter, (gpointer *) &name, (gpointer *) &setting_builder))
+			g_variant_builder_add (&conn_builder, "{sa{sv}}", name, setting_builder);
+		dict = g_variant_builder_end (&conn_builder);
+		g_hash_table_destroy (settings);
 	} else {
 		error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_USER_CANCELED,
 		                     "User cancelled");
 	}
 
-	request->callback (NM_SECRET_AGENT (self), request->connection, hash, error, request->callback_data);
+	request->callback (NM_SECRET_AGENT (self), request->connection, dict, error, request->callback_data);
 
-	g_clear_pointer (&hash, g_hash_table_unref);
+	g_clear_pointer (&dict, g_variant_unref);
 	g_clear_error (&error);
 	g_hash_table_remove (priv->requests, request_id);
 }
diff --git a/docs/libnm/Makefile.am b/docs/libnm/Makefile.am
index fb9e0bb519..b4f9d6d80d 100644
--- a/docs/libnm/Makefile.am
+++ b/docs/libnm/Makefile.am
@@ -62,8 +62,7 @@ GTKDOC_CFLAGS =				\
 	-I$(top_srcdir)/libnm		\
 	-I$(top_builddir)/libnm		\
 	-DNM_VERSION_MAX_ALLOWED=NM_VERSION_NEXT_STABLE \
-	$(GLIB_CFLAGS)			\
-	$(DBUS_CFLAGS)
+	$(GLIB_CFLAGS)
 
 GTKDOC_LIBS =  \
 	$(top_builddir)/libnm/libnm.la \
diff --git a/libnm-core/Makefile.libnm-core b/libnm-core/Makefile.libnm-core
index c68a720f7e..22566e0638 100644
--- a/libnm-core/Makefile.libnm-core
+++ b/libnm-core/Makefile.libnm-core
@@ -81,6 +81,5 @@ libnm_core_sources =				\
 	$(core)/nm-setting-wireless.c		\
 	$(core)/nm-setting.c			\
 	$(core)/nm-simple-connection.c		\
-	$(core)/nm-utils.c			\
-	$(core)/nm-value-transforms.c
+	$(core)/nm-utils.c
 
diff --git a/libnm-core/nm-connection.c b/libnm-core/nm-connection.c
index 8dc18632d3..142fee4cd0 100644
--- a/libnm-core/nm-connection.c
+++ b/libnm-core/nm-connection.c
@@ -22,11 +22,9 @@
 
 #include <glib-object.h>
 #include <glib/gi18n.h>
-#include <dbus/dbus-glib.h>
 #include <string.h>
 #include "nm-connection.h"
-#include "nm-utils-internal.h"
-#include "nm-dbus-glib-types.h"
+#include "nm-utils.h"
 #include "nm-setting-private.h"
 
 #include "nm-setting-8021x.h"
@@ -243,35 +241,40 @@ nm_connection_get_setting_by_name (NMConnection *connection, const char *name)
 }
 
 static gboolean
-validate_permissions_type (GHashTable *hash, GError **error)
+validate_permissions_type (GVariant *variant, GError **error)
 {
-	GHashTable *s_con;
-	GValue *permissions;
+	GVariant *s_con;
+	GVariant *permissions;
+	gboolean valid = TRUE;
 
 	/* Ensure the connection::permissions item (if present) is the correct
 	 * type, otherwise the g_object_set() will throw a warning and ignore the
 	 * error, leaving us with no permissions.
 	 */
-	s_con = g_hash_table_lookup (hash, NM_SETTING_CONNECTION_SETTING_NAME);
-	if (s_con) {
-		permissions = g_hash_table_lookup (s_con, NM_SETTING_CONNECTION_PERMISSIONS);
-		if (permissions) {
-			if (!G_VALUE_HOLDS (permissions, G_TYPE_STRV)) {
-				g_set_error_literal (error,
-				                     NM_SETTING_ERROR,
-				                     NM_SETTING_ERROR_PROPERTY_TYPE_MISMATCH,
-				                     "Wrong permissions property type; should be an array of strings.");
-				return FALSE;
-			}
+	s_con = g_variant_lookup_value (variant, NM_SETTING_CONNECTION_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+	if (!s_con)
+		return TRUE;
+
+	permissions = g_variant_lookup_value (s_con, NM_SETTING_CONNECTION_PERMISSIONS, NULL);
+	if (permissions) {
+		if (!g_variant_is_of_type (permissions, G_VARIANT_TYPE_STRING_ARRAY)) {
+			g_set_error_literal (error,
+			                     NM_SETTING_ERROR,
+			                     NM_SETTING_ERROR_PROPERTY_TYPE_MISMATCH,
+			                     "Wrong permissions property type; should be a list of strings.");
+			valid = FALSE;
 		}
+		g_variant_unref (permissions);
 	}
-	return TRUE;
+
+	g_variant_unref (s_con);
+	return valid;
 }
 
 /**
  * nm_connection_replace_settings:
  * @connection: a #NMConnection
- * @new_settings: (element-type utf8 GLib.HashTable): a #GHashTable of settings
+ * @new_settings: a #GVariant of type %NM_VARIANT_TYPE_CONNECTION, with the new settings
  * @error: location to store error, or %NULL
  *
  * Replaces @connection's settings with @new_settings (which must be
@@ -283,18 +286,18 @@ validate_permissions_type (GHashTable *hash, GError **error)
  **/
 gboolean
 nm_connection_replace_settings (NMConnection *connection,
-                                GHashTable *new_settings,
+                                GVariant *new_settings,
                                 GError **error)
 {
 	NMConnectionPrivate *priv;
-	GHashTableIter iter;
+	GVariantIter iter;
 	const char *setting_name;
-	GHashTable *setting_hash;
+	GVariant *setting_dict;
 	GSList *settings = NULL, *s;
 	gboolean changed;
 
 	g_return_val_if_fail (NM_IS_CONNECTION (connection), FALSE);
-	g_return_val_if_fail (new_settings != NULL, FALSE);
+	g_return_val_if_fail (g_variant_is_of_type (new_settings, NM_VARIANT_TYPE_CONNECTION), FALSE);
 	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
 
 	priv = NM_CONNECTION_GET_PRIVATE (connection);
@@ -302,8 +305,8 @@ nm_connection_replace_settings (NMConnection *connection,
 	if (!validate_permissions_type (new_settings, error))
 		return FALSE;
 
-	g_hash_table_iter_init (&iter, new_settings);
-	while (g_hash_table_iter_next (&iter, (gpointer) &setting_name, (gpointer) &setting_hash)) {
+	g_variant_iter_init (&iter, new_settings);
+	while (g_variant_iter_next (&iter, "{&s@a{sv}}", &setting_name, &setting_dict)) {
 		NMSetting *setting;
 		GType type;
 
@@ -313,15 +316,19 @@ nm_connection_replace_settings (NMConnection *connection,
 			             NM_CONNECTION_ERROR,
 			             NM_CONNECTION_ERROR_INVALID_SETTING,
 			             "unknown setting name '%s'", setting_name);
+			g_variant_unref (setting_dict);
 			g_slist_free_full (settings, g_object_unref);
 			return FALSE;
 		}
 
-		setting = _nm_setting_new_from_dbus (type, setting_hash, new_settings, error);
+		setting = _nm_setting_new_from_dbus (type, setting_dict, new_settings, error);
+		g_variant_unref (setting_dict);
+
 		if (!setting) {
 			g_slist_free_full (settings, g_object_unref);
 			return FALSE;
 		}
+
 		settings = g_slist_prepend (settings, setting);
 	}
 
@@ -928,16 +935,16 @@ nm_connection_normalize (NMConnection *connection,
  * nm_connection_update_secrets:
  * @connection: the #NMConnection
  * @setting_name: the setting object name to which the secrets apply
- * @secrets: (element-type utf8 GObject.Value): a #GHashTable mapping
- * string:#GValue of setting property names and secrets of the given @setting_name
+ * @secrets: a #GVariant of secrets, of type %NM_VARIANT_TYPE_CONNECTION
+ *   or %NM_VARIANT_TYPE_SETTING
  * @error: location to store error, or %NULL
  *
- * Update the specified setting's secrets, given a hash table of secrets
+ * Update the specified setting's secrets, given a dictionary of secrets
  * intended for that setting (deserialized from D-Bus for example).  Will also
- * extract the given setting's secrets hash if given a hash of hashes, as would
- * be returned from nm_connection_to_dbus().  If @setting_name is %NULL, expects
- * a fully serialized #NMConnection as returned by nm_connection_to_dbus() and
- * will update all secrets from all settings contained in @secrets.
+ * extract the given setting's secrets hash if given a connection dictionary.
+ * If @setting_name is %NULL, expects a fully serialized #NMConnection as
+ * returned by nm_connection_to_dbus() and will update all secrets from all
+ * settings contained in @secrets.
  *
  * Returns: %TRUE if the secrets were successfully updated, %FALSE if the update
  * failed (tried to update secrets for a setting that doesn't exist, etc)
@@ -945,38 +952,28 @@ nm_connection_normalize (NMConnection *connection,
 gboolean
 nm_connection_update_secrets (NMConnection *connection,
                               const char *setting_name,
-                              GHashTable *secrets,
+                              GVariant *secrets,
                               GError **error)
 {
 	NMSetting *setting;
 	gboolean success = TRUE, updated = FALSE;
-	GHashTable *setting_hash = NULL;
-	GHashTableIter iter;
+	GVariant *setting_dict = NULL;
+	GVariantIter iter;
 	const char *key;
-	gboolean hashed_connection = FALSE;
+	gboolean full_connection;
 	int success_detail;
 
 	g_return_val_if_fail (NM_IS_CONNECTION (connection), FALSE);
-	g_return_val_if_fail (secrets != NULL, FALSE);
+	g_return_val_if_fail (   g_variant_is_of_type (secrets, NM_VARIANT_TYPE_SETTING)
+	                      || g_variant_is_of_type (secrets, NM_VARIANT_TYPE_CONNECTION), FALSE);
 	if (error)
 		g_return_val_if_fail (*error == NULL, FALSE);
 
 	/* Empty @secrets means success */
-	if (g_hash_table_size (secrets) == 0)
+	if (g_variant_n_children (secrets) == 0)
 		return TRUE;
 
-	/* For backwards compatibility, this function accepts either a hashed
-	 * connection (GHashTable of GHashTables of GValues) or a single hashed
-	 * setting (GHashTable of GValues).
-	 */
-	g_hash_table_iter_init (&iter, secrets);
-	while (g_hash_table_iter_next (&iter, (gpointer) &key, NULL)) {
-		if (nm_setting_lookup_type (key) != G_TYPE_INVALID) {
-			/* @secrets looks like a hashed connection */
-			hashed_connection = TRUE;
-			break;
-		}
-	}
+	full_connection = g_variant_is_of_type (secrets, NM_VARIANT_TYPE_CONNECTION);
 
 	if (setting_name) {
 		/* Update just one setting's secrets */
@@ -989,10 +986,10 @@ nm_connection_update_secrets (NMConnection *connection,
 			return FALSE;
 		}
 
-		if (hashed_connection) {
-			setting_hash = g_hash_table_lookup (secrets, setting_name);
-			if (!setting_hash) {
-				/* The hashed connection that didn't contain any secrets for
+		if (full_connection) {
+			setting_dict = g_variant_lookup_value (secrets, setting_name, NM_VARIANT_TYPE_SETTING);
+			if (!setting_dict) {
+				/* The connection dictionary didn't contain any secrets for
 				 * @setting_name; just return success.
 				 */
 				return TRUE;
@@ -1001,16 +998,18 @@ nm_connection_update_secrets (NMConnection *connection,
 
 		g_signal_handlers_block_by_func (setting, (GCallback) setting_changed_cb, connection);
 		success_detail = _nm_setting_update_secrets (setting,
-		                                             setting_hash ? setting_hash : secrets,
+		                                             setting_dict ? setting_dict : secrets,
 		                                             error);
 		g_signal_handlers_unblock_by_func (setting, (GCallback) setting_changed_cb, connection);
 
+		g_clear_pointer (&setting_dict, g_variant_unref);
+
 		if (success_detail == NM_SETTING_UPDATE_SECRET_ERROR)
 			return FALSE;
 		if (success_detail == NM_SETTING_UPDATE_SECRET_SUCCESS_MODIFIED)
 			updated = TRUE;
 	} else {
-		if (!hashed_connection) {
+		if (!full_connection) {
 			g_set_error_literal (error,
 			                     NM_CONNECTION_ERROR,
 			                     NM_CONNECTION_ERROR_SETTING_NOT_FOUND,
@@ -1019,8 +1018,8 @@ nm_connection_update_secrets (NMConnection *connection,
 		}
 
 		/* check first, whether all the settings exist... */
-		g_hash_table_iter_init (&iter, secrets);
-		while (g_hash_table_iter_next (&iter, (gpointer) &key, NULL)) {
+		g_variant_iter_init (&iter, secrets);
+		while (g_variant_iter_next (&iter, "{&s@a{sv}}", &key, NULL)) {
 			setting = nm_connection_get_setting_by_name (connection, key);
 			if (!setting) {
 				g_set_error_literal (error,
@@ -1031,16 +1030,18 @@ nm_connection_update_secrets (NMConnection *connection,
 			}
 		}
 
-		/* Update each setting with any secrets from the hashed connection */
-		g_hash_table_iter_init (&iter, secrets);
-		while (g_hash_table_iter_next (&iter, (gpointer) &key, (gpointer) &setting_hash)) {
+		/* Update each setting with any secrets from the connection dictionary */
+		g_variant_iter_init (&iter, secrets);
+		while (g_variant_iter_next (&iter, "{&s@a{sv}}", &key, &setting_dict)) {
 			/* Update the secrets for this setting */
 			setting = nm_connection_get_setting_by_name (connection, key);
 
 			g_signal_handlers_block_by_func (setting, (GCallback) setting_changed_cb, connection);
-			success_detail = _nm_setting_update_secrets (setting, setting_hash, error);
+			success_detail = _nm_setting_update_secrets (setting, setting_dict, error);
 			g_signal_handlers_unblock_by_func (setting, (GCallback) setting_changed_cb, connection);
 
+			g_variant_unref (setting_dict);
+
 			if (success_detail == NM_SETTING_UPDATE_SECRET_ERROR) {
 				success = FALSE;
 				break;
@@ -1184,46 +1185,43 @@ nm_connection_clear_secrets_with_flags (NMConnection *connection,
  * @connection: the #NMConnection
  * @flags: serialization flags, e.g. %NM_CONNECTION_SERIALIZE_ALL
  *
- * Converts the #NMConnection into a #GHashTable describing the connection,
- * suitable for marshalling over D-Bus or otherwise serializing.  The hash table
- * mapping is string:#GHashTable with each element in the returned hash
- * representing a #NMSetting object.  The keys are setting object names, and the
- * values are #GHashTables mapping string:GValue, each of which represents the
- * properties of the #NMSetting object.
- *
- * Returns: (transfer full) (element-type utf8 GLib.HashTable): a new
- * #GHashTable describing the connection, its settings, and each setting's
- * properties.  The caller owns the hash table and must unref the hash table
- * with g_hash_table_unref() when it is no longer needed.
+ * Converts the #NMConnection into a #GVariant of type
+ * %NM_VARIANT_TYPE_CONNECTION describing the connection, suitable for
+ * marshalling over D-Bus or otherwise serializing.
+ *
+ * Returns: (transfer none): a new floating #GVariant describing the connection,
+ * its settings, and each setting's properties.
  **/
-GHashTable *
-nm_connection_to_dbus (NMConnection *connection, NMConnectionSerializationFlags flags)
+GVariant *
+nm_connection_to_dbus (NMConnection *connection,
+                       NMConnectionSerializationFlags flags)
 {
 	NMConnectionPrivate *priv;
+	GVariantBuilder builder;
 	GHashTableIter iter;
 	gpointer key, data;
-	GHashTable *ret, *setting_hash;
+	GVariant *setting_dict, *ret;
 
 	g_return_val_if_fail (NM_IS_CONNECTION (connection), NULL);
-
-	ret = g_hash_table_new_full (g_str_hash, g_str_equal,
-	                             g_free, (GDestroyNotify) g_hash_table_destroy);
-
 	priv = NM_CONNECTION_GET_PRIVATE (connection);
 
+	g_variant_builder_init (&builder, NM_VARIANT_TYPE_CONNECTION);
+
 	/* Add each setting's hash to the main hash */
 	g_hash_table_iter_init (&iter, priv->settings);
 	while (g_hash_table_iter_next (&iter, &key, &data)) {
 		NMSetting *setting = NM_SETTING (data);
 
-		setting_hash = _nm_setting_to_dbus (setting, connection, flags);
-		if (setting_hash)
-			g_hash_table_insert (ret, g_strdup (nm_setting_get_name (setting)), setting_hash);
+		setting_dict = _nm_setting_to_dbus (setting, connection, flags);
+		if (setting_dict)
+			g_variant_builder_add (&builder, "{s@a{sv}}", nm_setting_get_name (setting), setting_dict);
 	}
 
+	ret = g_variant_builder_end (&builder);
+
 	/* Don't send empty hashes */
-	if (g_hash_table_size (ret) < 1) {
-		g_hash_table_destroy (ret);
+	if (g_variant_n_children (ret) == 0) {
+		g_variant_unref (ret);
 		ret = NULL;
 	}
 
diff --git a/libnm-core/nm-connection.h b/libnm-core/nm-connection.h
index 3987f61b41..de1cd528a4 100644
--- a/libnm-core/nm-connection.h
+++ b/libnm-core/nm-connection.h
@@ -141,6 +141,25 @@ NMSetting    *nm_connection_get_setting_by_name (NMConnection *connection,
                                                  const char   *name);
 
 /**
+ * NM_VARIANT_TYPE_CONNECTION:
+ *
+ * #GVariantType for a dictionary mapping from setting names to
+ * %NM_VARIANT_TYPE_SETTING variants. This is used to represent an
+ * #NMConnection, and is the type taken by nm_simple_connection_new_from_dbus()
+ * and returned from nm_connection_to_dbus().
+ */
+#define NM_VARIANT_TYPE_CONNECTION (G_VARIANT_TYPE ("a{sa{sv}}"))
+
+/**
+ * NM_VARIANT_TYPE_SETTING:
+ *
+ * #GVariantType for a dictionary mapping from property names to values. This is
+ * an alias for %G_VARIANT_TYPE_VARDICT, and is the type of each element of
+ * an %NM_VARIANT_TYPE_CONNECTION dictionary.
+ */
+#define NM_VARIANT_TYPE_SETTING G_VARIANT_TYPE_VARDICT
+
+/**
  * NMConnectionSerializationFlags:
  * @NM_CONNECTION_SERIALIZE_ALL: serialize all properties (including secrets)
  * @NM_CONNECTION_SERIALIZE_NO_SECRETS: do not include secrets
@@ -155,11 +174,11 @@ typedef enum { /*< flags >*/
 	NM_CONNECTION_SERIALIZE_ONLY_SECRETS = 0x00000002,
 } NMConnectionSerializationFlags;
 
-GHashTable   *nm_connection_to_dbus       (NMConnection *connection,
+GVariant     *nm_connection_to_dbus       (NMConnection *connection,
                                            NMConnectionSerializationFlags flags);
 
 gboolean      nm_connection_replace_settings (NMConnection *connection,
-                                              GHashTable *new_settings,
+                                              GVariant *new_settings,
                                               GError **error);
 
 void          nm_connection_replace_settings_from_connection (NMConnection *connection,
@@ -193,7 +212,7 @@ void          nm_connection_clear_secrets_with_flags (NMConnection *connection,
 
 gboolean      nm_connection_update_secrets (NMConnection *connection,
                                             const char *setting_name,
-                                            GHashTable *secrets,
+                                            GVariant *secrets,
                                             GError **error);
 
 void          nm_connection_set_path      (NMConnection *connection,
diff --git a/libnm-core/nm-core-internal.h b/libnm-core/nm-core-internal.h
index c7f31f1957..68d60df451 100644
--- a/libnm-core/nm-core-internal.h
+++ b/libnm-core/nm-core-internal.h
@@ -78,4 +78,9 @@ GPtrArray *_nm_utils_copy_array (const GPtrArray *array,
                                  GDestroyNotify free_func);
 GPtrArray *_nm_utils_copy_object_array (const GPtrArray *array);
 
+/* compat */
+
+GVariant   *_nm_utils_connection_hash_to_dict (GHashTable *hash);
+GHashTable *_nm_utils_connection_dict_to_hash (GVariant *dict);
+
 #endif
diff --git a/libnm-core/nm-property-compare.c b/libnm-core/nm-property-compare.c
index 4f6fae8bb8..d3ff94de3d 100644
--- a/libnm-core/nm-property-compare.c
+++ b/libnm-core/nm-property-compare.c
@@ -26,479 +26,68 @@
 #include <string.h>
 #include <math.h>
 #include <netinet/in.h>
-#include <dbus/dbus-glib.h>
-
-#include "nm-dbus-glib-types.h"
-
-static gboolean
-type_is_fixed_size (GType type, gsize *tsize)
-{
-	switch (type) {
-	case G_TYPE_CHAR:
-		if (tsize) *tsize = sizeof (char);
-		return TRUE;
-	case G_TYPE_UCHAR:
-		if (tsize) *tsize = sizeof (guchar);
-		return TRUE;
-	case G_TYPE_BOOLEAN:
-		if (tsize) *tsize = sizeof (gboolean);
-		return TRUE;
-	case G_TYPE_LONG:
-		if (tsize) *tsize = sizeof (glong);
-		return TRUE;
-	case G_TYPE_ULONG:
-		if (tsize) *tsize = sizeof (gulong);
-		return TRUE;
-	case G_TYPE_INT:
-		if (tsize) *tsize = sizeof (gint);
-		return TRUE;
-	case G_TYPE_UINT:
-		if (tsize) *tsize = sizeof (guint);
-		return TRUE;
-	case G_TYPE_INT64:
-		if (tsize) *tsize = sizeof (gint64);
-		return TRUE;
-	case G_TYPE_UINT64:
-		if (tsize) *tsize = sizeof (guint64);
-		return TRUE;
-	case G_TYPE_FLOAT:
-		if (tsize) *tsize = sizeof (gfloat);
-		return TRUE;
-	case G_TYPE_DOUBLE:
-		if (tsize) *tsize = sizeof (gdouble);
-		return TRUE;
-	default:
-		return FALSE;
-	}
-}
-
-#define FLOAT_FACTOR 0.00000001
+#include <gio/gio.h>
 
 static gint
-nm_property_compare_fixed (const GValue *value1, const GValue *value2)
+_nm_property_compare_collection (GVariant *value1, GVariant *value2)
 {
-	int ret = 0;
+	GVariant *child1, *child2;
+	int i, len1, len2;
+	int ret;
 
-	switch (G_VALUE_TYPE (value1)) {
-	case G_TYPE_CHAR: {
-		gchar val1 = g_value_get_schar (value1);
-		gchar val2 = g_value_get_schar (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_UCHAR: {
-		guchar val1 = g_value_get_uchar (value1);
-		guchar val2 = g_value_get_uchar (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_BOOLEAN: {
-		gboolean val1 = g_value_get_boolean (value1);
-		gboolean val2 = g_value_get_boolean (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_LONG: {
-		glong val1 = g_value_get_long (value1);
-		glong val2 = g_value_get_long (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_ULONG: {
-		gulong val1 = g_value_get_ulong (value1);
-		gulong val2 = g_value_get_ulong (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_INT: {
-		gint val1 = g_value_get_int (value1);
-		gint val2 = g_value_get_int (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_UINT: {
-		guint val1 = g_value_get_uint (value1);
-		guint val2 = g_value_get_uint (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_INT64: {
-		gint64 val1 = g_value_get_int64 (value1);
-		gint64 val2 = g_value_get_int64 (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_UINT64: {
-		guint64 val1 = g_value_get_uint64 (value1);
-		guint64 val2 = g_value_get_uint64 (value2);
-		if (val1 != val2)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_FLOAT: {
-		gfloat val1 = g_value_get_float (value1);
-		gfloat val2 = g_value_get_float (value2);
-		/* Can't use == or != here due to inexactness of FP */
-		if (fabsf (val1 - val2) > FLOAT_FACTOR)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	case G_TYPE_DOUBLE: {
-		gdouble val1 = g_value_get_double (value1);
-		gdouble val2 = g_value_get_double (value2);
-		if (fabs (val1 - val2) > FLOAT_FACTOR)
-			ret = val1 < val2 ? -1 : val1 > val2;
-		break;
-	}
-	default:
-		g_warning ("Unhandled fixed size type '%s'", G_VALUE_TYPE_NAME (value1));
-	}
-
-	return ret;
-}
-
-static gint
-nm_property_compare_string (const GValue *value1, const GValue *value2)
-{
-	const char *str1 = g_value_get_string (value1);
-	const char *str2 = g_value_get_string (value2);
+	len1 = g_variant_n_children (value1);
+	len2 = g_variant_n_children (value2);
 
-	if (str1 == str2)
-		return 0;
-
-	if (!str1)
-		return 1;
-	if (!str2)
-		return -1;
-
-	return strcmp (str1, str2);
-}
+	if (len1 != len2)
+		return len1 < len2 ? -1 : len1 > len2;
 
-static gint
-nm_property_compare_strv (const GValue *value1, const GValue *value2)
-{
-	char **strv1;
-	char **strv2;
-	gint ret;
-	guint i = 0;
+	for (i = 0; i < len1; i++) {
+		child1 = g_variant_get_child_value (value1, i);
+		child2 = g_variant_get_child_value (value2, i);
 
-	strv1 = (char **) g_value_get_boxed (value1);
-	strv2 = (char **) g_value_get_boxed (value2);
+		ret = nm_property_compare (child1, child2);
+		g_variant_unref (child1);
+		g_variant_unref (child2);
 
-	while (strv1[i] && strv2[i]) {
-		ret = strcmp (strv1[i], strv2[i]);
 		if (ret)
 			return ret;
-		i++;
-	}
-
-	if (strv1[i] == NULL && strv2[i] == NULL)
-		return 0;
-
-	if (strv1[i])
-		return 1;
-
-	return -1;
-}
-
-static void
-_gvalue_destroy (gpointer data)
-{
-	GValue *value = (GValue *) data;
-
-	g_value_unset (value);
-	g_slice_free (GValue, value);
-}
-
-static GValue *
-_gvalue_dup (const GValue *value)
-{
-	GValue *dup;
-
-	dup = g_slice_new0 (GValue);
-	g_value_init (dup, G_VALUE_TYPE (value));
-	g_value_copy (value, dup);
-
-	return dup;
-}
-
-static void
-iterate_collection (const GValue *value, gpointer user_data)
-{
-	GSList **list = (GSList **) user_data;
-
-	*list = g_slist_prepend (*list, _gvalue_dup (value));
-}
-
-static gint
-nm_property_compare_collection (const GValue *value1, const GValue *value2)
-{
-	gint ret;
-	guint len1;
-	guint len2;
-	GType value_type = dbus_g_type_get_collection_specialization (G_VALUE_TYPE (value1));
-	gsize element_size = 0;
-
-	if (type_is_fixed_size (value_type, &element_size)) {
-		gpointer data1 = NULL;
-		gpointer data2 = NULL;
-
-		dbus_g_type_collection_get_fixed ((GValue *) value1, &data1, &len1);
-		dbus_g_type_collection_get_fixed ((GValue *) value2, &data2, &len2);
-
-		if (len1 != len2)
-			ret = len1 < len2 ? -1 : len1 > len2;
-		else
-			ret = memcmp (data1, data2, len1 * element_size);
-	} else {
-		GSList *list1 = NULL;
-		GSList *list2 = NULL;
-
-		dbus_g_type_collection_value_iterate (value1, iterate_collection, &list1);
-		len1 = g_slist_length (list1);
-		dbus_g_type_collection_value_iterate (value2, iterate_collection, &list2);
-		len2 = g_slist_length (list2);
-
-		if (len1 != len2)
-			ret = len1 < len2 ? -1 : len1 > len2;
-		else {
-			GSList *iter1;
-			GSList *iter2;
-
-			for (iter1 = list1, iter2 = list2, ret = 0;
-			     ret == 0 && iter1 && iter2;
-			     iter1 = iter1->next, iter2 = iter2->next)
-				ret = nm_property_compare ((GValue *) iter1->data, (GValue *) iter2->data);
-		}
-
-		g_slist_free_full (list1, _gvalue_destroy);
-		g_slist_free_full (list2, _gvalue_destroy);
 	}
 
-	return ret;
-}
-
-static void
-iterate_map (const GValue *key_val,
-             const GValue *value_val,
-             gpointer user_data)
-{
-	GHashTable **hash = (GHashTable **) user_data;
-
-	g_hash_table_insert (*hash, g_value_dup_string (key_val), _gvalue_dup (value_val));
-}
-
-typedef struct {
-	GHashTable *hash2;
-	gint ret;
-} CompareMapInfo;
-
-static void
-compare_one_map_item (gpointer key, gpointer val, gpointer user_data)
-{
-	CompareMapInfo *info = (CompareMapInfo *) user_data;
-	GValue *value2;
-
-	if (info->ret)
-		return;
-
-	value2 = (GValue *) g_hash_table_lookup (info->hash2, key);
-	if (value2)
-		info->ret = nm_property_compare ((GValue *) val, value2);
-	else
-		info->ret = 1;
+	return 0;
 }
 
 static gint
-nm_property_compare_map (const GValue *value1, const GValue *value2)
+_nm_property_compare_strdict (GVariant *value1, GVariant *value2)
 {
-	GHashTable *hash1 = NULL;
-	GHashTable *hash2 = NULL;
-	guint len1;
-	guint len2;
-	gint ret = 0;
+	GVariantIter iter;
+	int len1, len2;
+	const char *key, *val1, *val2;
+	int ret;
 
-	if (dbus_g_type_get_map_key_specialization (G_VALUE_TYPE (value1)) != G_TYPE_STRING) {
-		g_warning ("Can not compare maps with '%s' for keys",
-		           g_type_name (dbus_g_type_get_map_key_specialization (G_VALUE_TYPE (value1))));
-		return 0;
-	}
-
-	hash1 = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, _gvalue_destroy);
-	dbus_g_type_map_value_iterate (value1, iterate_map, &hash1);
-	len1 = g_hash_table_size (hash1);
-
-	hash2 = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, _gvalue_destroy);
-	dbus_g_type_map_value_iterate (value2, iterate_map, &hash2);
-	len2 = g_hash_table_size (hash2);
+	len1 = g_variant_n_children (value1);
+	len2 = g_variant_n_children (value2);
 
 	if (len1 != len2)
-		ret = len1 < len2 ? -1 : len1 > len2;
-	else {
-		CompareMapInfo info;
-
-		info.ret = 0;
-		info.hash2 = hash2;
-		g_hash_table_foreach (hash1, compare_one_map_item, &info);
-		ret = info.ret;
-	}
-
-	g_hash_table_destroy (hash1);
-	g_hash_table_destroy (hash2);
-
-	return ret;
-}
-
-static gint
-_gvalue_ip6_address_compare (const GValue *value1, const GValue *value2)
-{
-	GValueArray *values1, *values2;
-	GValue *tmp_val;
-	GByteArray *addr1, *addr2;
-	guint32 prefix1, prefix2;
-	GByteArray *gw1, *gw2;
-	gint ret = 0;
-	int i;
-
-	/* IP6 addresses are GValueArrays (see nm-dbus-glib-types.h) */
-	values1 = g_value_get_boxed (value1);
-	values2 = g_value_get_boxed (value2);
-
-	/* Since they are NM IPv6 address structures, we expect both
-	 * to contain two elements as specified in nm-dbus-glib-types.h.
-	 */
-	g_return_val_if_fail (values1->n_values == 3, 0);
-	g_return_val_if_fail (values2->n_values == 3, 0);
+		return len1 < len2 ? -1 : len1 > len2;
 
-	/* First struct IPv6 address */
-	tmp_val = g_value_array_get_nth (values1, 0);
-	addr1 = g_value_get_boxed (tmp_val);
-	/* First struct IPv6 prefix */
-	tmp_val = g_value_array_get_nth (values1, 1);
-	prefix1 = g_value_get_uint (tmp_val);
-	/* First struct IPv6 gateway */
-	tmp_val = g_value_array_get_nth (values1, 2);
-	gw1 = g_value_get_boxed (tmp_val);
+	g_variant_iter_init (&iter, value1);
+	while (g_variant_iter_next (&iter, "{&s&s}", &key, &val1)) {
+		if (!g_variant_lookup (value2, key, "&s", &val2))
+			return -1;
 
-	/* Second struct IPv6 address */
-	tmp_val = g_value_array_get_nth (values2, 0);
-	addr2 = g_value_get_boxed (tmp_val);
-	/* Second struct IPv6 prefix */
-	tmp_val = g_value_array_get_nth (values2, 1);
-	prefix2 = g_value_get_uint (tmp_val);
-	/* Second struct IPv6 gateway */
-	tmp_val = g_value_array_get_nth (values2, 2);
-	gw2 = g_value_get_boxed (tmp_val);
-
-	/* Compare IPv6 addresses */
-	if (prefix1 != prefix2)
-		return prefix1 < prefix2 ? -1 : prefix1 > prefix2;
-
-	if (!IN6_ARE_ADDR_EQUAL ((struct in6_addr *)addr1->data, (struct in6_addr *)addr2->data)) {
-		for (i = 0; ret == 0 && i < addr1->len; i++)
-			ret = addr1->data[i] < addr2->data[i] ? -1 : addr1->data[i] > addr2->data[i];
-	}
-
-	if (!IN6_ARE_ADDR_EQUAL ((struct in6_addr *) gw1->data, (struct in6_addr *) gw2->data)) {
-		for (i = 0; ret == 0 && i < gw1->len; i++)
-			ret = gw1->data[i] < gw2->data[i] ? -1 : gw1->data[i] > gw2->data[i];
-	}
-
-	return ret;
-}
-
-static gint
-_gvalue_ip6_route_compare (const GValue *value1, const GValue *value2)
-{
-	GValueArray *values1, *values2;
-	GValue *tmp_val;
-	GByteArray *dest1, *dest2;
-	GByteArray *next_hop1, *next_hop2;
-	guint32 prefix1, prefix2;
-	guint32 metric1, metric2;
-	gint ret = 0;
-	int i;
-
-	/* IP6 routes are GValueArrays (see nm-dbus-glib-types.h) */
-	values1 = g_value_get_boxed (value1);
-	values2 = g_value_get_boxed (value2);
-
-	/* Since they are NM IPv6 route structures, we expect both
-	 * to contain 4 elements as specified in nm-dbus-glib-types.h.
-	 */
-	g_return_val_if_fail (values1->n_values == 4, 0);
-	g_return_val_if_fail (values2->n_values == 4, 0);
-
-	/* First struct IPv6 route */
-	tmp_val = g_value_array_get_nth (values1, 0);
-	dest1 = g_value_get_boxed (tmp_val);
-	tmp_val = g_value_array_get_nth (values1, 1);
-	prefix1 = g_value_get_uint (tmp_val);
-	tmp_val = g_value_array_get_nth (values1, 2);
-	next_hop1 = g_value_get_boxed (tmp_val);
-	tmp_val = g_value_array_get_nth (values1, 3);
-	metric1 = g_value_get_uint (tmp_val);
-
-	/* Second struct IPv6 route */
-	tmp_val = g_value_array_get_nth (values2, 0);
-	dest2 = g_value_get_boxed (tmp_val);
-	tmp_val = g_value_array_get_nth (values2, 1);
-	prefix2 = g_value_get_uint (tmp_val);
-	tmp_val = g_value_array_get_nth (values2, 2);
-	next_hop2 = g_value_get_boxed (tmp_val);
-	tmp_val = g_value_array_get_nth (values2, 3);
-	metric2 = g_value_get_uint (tmp_val);
-
-	/* Compare the routes */
-	if (prefix1 != prefix2)
-		return prefix1 < prefix2 ? -1 : prefix1 > prefix2;
-
-	if (!IN6_ARE_ADDR_EQUAL ((struct in6_addr *)dest1->data, (struct in6_addr *)dest2->data)) {
-		for (i = 0; ret == 0 && i < dest1->len; i++)
-			ret = dest1->data[i] < dest2->data[i] ? -1 : dest1->data[i] > dest2->data[i];
-	}
-
-	if (!IN6_ARE_ADDR_EQUAL ((struct in6_addr *)next_hop1->data, (struct in6_addr *)next_hop2->data)) {
-		for (i = 0; ret == 0 && i < next_hop1->len; i++)
-			ret = next_hop1->data[i] < next_hop2->data[i] ? -1 : next_hop1->data[i] > next_hop2->data[i];
+		ret = strcmp (val1, val2);
+		if (ret)
+			return ret;
 	}
 
-	if (metric1 != metric2)
-		ret = metric1 < metric2 ? -1 : metric1 > metric2;
-
-	return ret;
-}
-
-static gint
-nm_property_compare_struct (const GValue *value1, const GValue *value2)
-{
-	/* value1 and value2 must contain the same type since
-	 * nm_property_compare() enforced that already.
-	 */
-
-	if (G_VALUE_HOLDS (value1, DBUS_TYPE_G_IP6_ADDRESS)) {
-		return _gvalue_ip6_address_compare (value1, value2);
-	} else if (G_VALUE_HOLDS (value1, DBUS_TYPE_G_IP6_ROUTE)) {
-		return _gvalue_ip6_route_compare (value1, value2);
-	} else {
-		g_warning ("Don't know how to compare structures");
-		return (value1 == value2);
-	}
+	return 0;
 }
 
 int
-nm_property_compare (const GValue *value1, const GValue *value2)
+nm_property_compare (GVariant *value1, GVariant *value2)
 {
-	GType type1;
-	GType type2;
+	const GVariantType *type1;
+	const GVariantType *type2;
 	gint ret;
 
 	if (value1 == value2)
@@ -508,42 +97,22 @@ nm_property_compare (const GValue *value1, const GValue *value2)
 	if (!value2)
 		return -1;
 
-	type1 = G_VALUE_TYPE (value1);
-	type2 = G_VALUE_TYPE (value2);
+	type1 = g_variant_get_type (value1);
+	type2 = g_variant_get_type (value2);
 
-	if (type1 != type2)
+	if (!g_variant_type_equal (type1, type2))
 		return type1 < type2 ? -1 : type1 > type2;
 
-	if (type_is_fixed_size (type1, NULL))
-		ret = nm_property_compare_fixed (value1, value2);
-	else if (type1 == G_TYPE_STRING)
-		ret = nm_property_compare_string (value1, value2);
-	else if (G_VALUE_HOLDS_BOXED (value1)) {
-		gpointer p1 = g_value_get_boxed (value1);
-		gpointer p2 = g_value_get_boxed (value2);
-
-		if (p1 == p2)
-			ret = 0; /* Exactly the same values */
-		else if (!p1)
-			ret = 1; /* The comparision functions below don't handle NULLs */
-		else if (!p2)
-			ret = -1; /* The comparision functions below don't handle NULLs */
-		else if (type1 == G_TYPE_STRV)
-			ret = nm_property_compare_strv (value1, value2);
-		else if (dbus_g_type_is_collection (type1))
-			ret = nm_property_compare_collection (value1, value2);
-		else if (dbus_g_type_is_map (type1))
-			ret = nm_property_compare_map (value1, value2);
-		else if (dbus_g_type_is_struct (type1))
-			ret = nm_property_compare_struct (value1, value2);
-		else if (type1 == G_TYPE_VALUE)
-			ret = nm_property_compare ((GValue *) g_value_get_boxed (value1), (GValue *) g_value_get_boxed (value2));
-		else {
-			g_warning ("Don't know how to compare boxed types '%s'", g_type_name (type1));
-			ret = value1 == value2;
-		}
-	} else {
-		g_warning ("Don't know how to compare types '%s'", g_type_name (type1));
+	if (g_variant_type_is_basic (type1))
+		ret = g_variant_compare (value1, value2);
+	else if (g_variant_is_of_type (value1, G_VARIANT_TYPE ("a{ss}")))
+		ret = _nm_property_compare_strdict (value1, value2);
+	else if (g_variant_type_is_array (type1))
+		ret = _nm_property_compare_collection (value1, value2);
+	else if (g_variant_type_is_tuple (type1))
+		ret = _nm_property_compare_collection (value1, value2);
+	else {
+		g_warning ("Don't know how to compare variant type '%s'", (const char *) type1);
 		ret = value1 == value2;
 	}
 
diff --git a/libnm-core/nm-property-compare.h b/libnm-core/nm-property-compare.h
index 72fc76baf7..33016787ff 100644
--- a/libnm-core/nm-property-compare.h
+++ b/libnm-core/nm-property-compare.h
@@ -23,8 +23,8 @@
 #ifndef __NM_PROPERTY_COMPARE_H__
 #define __NM_PROPERTY_COMPARE_H__
 
-#include <glib-object.h>
+#include <glib.h>
 
-int nm_property_compare (const GValue *value1, const GValue *value2);
+int nm_property_compare (GVariant *value1, GVariant *value2);
 
 #endif /* __NM_PROPERTY_COMPARE_H__ */
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c
index 0a63b74043..1d40f8f148 100644
--- a/libnm-core/nm-setting-8021x.c
+++ b/libnm-core/nm-setting-8021x.c
@@ -21,12 +21,10 @@
  */
 
 #include <string.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-8021x.h"
 #include "nm-utils.h"
-#include "nm-dbus-glib-types.h"
 #include "crypto.h"
 #include "nm-utils-private.h"
 #include "nm-setting-private.h"
@@ -3188,7 +3186,7 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_802_1X_CA_CERT,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
@@ -3257,7 +3255,7 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_802_1X_CLIENT_CERT,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
@@ -3370,7 +3368,7 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_802_1X_PHASE2_CA_CERT,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
@@ -3444,7 +3442,7 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_802_1X_PHASE2_CLIENT_CERT,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
@@ -3493,7 +3491,7 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
 		                     NM_SETTING_PARAM_SECRET |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_802_1X_PASSWORD_RAW,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
@@ -3548,7 +3546,7 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_802_1X_PRIVATE_KEY,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
@@ -3617,7 +3615,7 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
diff --git a/libnm-core/nm-setting-bluetooth.c b/libnm-core/nm-setting-bluetooth.c
index 44e71e06da..8791744a04 100644
--- a/libnm-core/nm-setting-bluetooth.c
+++ b/libnm-core/nm-setting-bluetooth.c
@@ -24,7 +24,6 @@
 #include <net/ethernet.h>
 #include <glib/gi18n.h>
 
-#include "nm-dbus-glib-types.h"
 #include "nm-setting-bluetooth.h"
 #include "nm-setting-cdma.h"
 #include "nm-setting-gsm.h"
@@ -276,7 +275,7 @@ nm_setting_bluetooth_class_init (NMSettingBluetoothClass *setting_class)
 		                      NM_SETTING_PARAM_INFERRABLE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_BLUETOOTH_BDADDR,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 
diff --git a/libnm-core/nm-setting-bond.c b/libnm-core/nm-setting-bond.c
index 22ef5dd213..c7eb9b2db5 100644
--- a/libnm-core/nm-setting-bond.c
+++ b/libnm-core/nm-setting-bond.c
@@ -24,13 +24,11 @@
 #include <errno.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-bond.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-setting-private.h"
 
 /**
@@ -734,11 +732,12 @@ nm_setting_bond_class_init (NMSettingBondClass *setting_class)
 		                     NM_SETTING_PARAM_INFERRABLE |
 		                     G_PARAM_STATIC_STRINGS));
 	 _nm_setting_class_transform_property (parent_class, NM_SETTING_BOND_OPTIONS,
-	                                       DBUS_TYPE_G_MAP_OF_STRING,
+	                                       G_VARIANT_TYPE ("a{ss}"),
 	                                       _nm_utils_strdict_to_dbus,
 	                                       _nm_utils_strdict_from_dbus);
 
-	 _nm_setting_class_add_dbus_only_property (parent_class, "interface-name", G_TYPE_STRING,
+	 _nm_setting_class_add_dbus_only_property (parent_class, "interface-name",
+	                                           G_VARIANT_TYPE_STRING,
 	                                           _nm_setting_get_deprecated_virtual_interface_name,
 	                                           NULL);
 }
diff --git a/libnm-core/nm-setting-bridge-port.c b/libnm-core/nm-setting-bridge-port.c
index b4826f3f56..ffd21638c8 100644
--- a/libnm-core/nm-setting-bridge-port.c
+++ b/libnm-core/nm-setting-bridge-port.c
@@ -22,7 +22,6 @@
 #include <string.h>
 #include <ctype.h>
 #include <stdlib.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-bridge-port.h"
diff --git a/libnm-core/nm-setting-bridge.c b/libnm-core/nm-setting-bridge.c
index 49bca2e813..720f5cb278 100644
--- a/libnm-core/nm-setting-bridge.c
+++ b/libnm-core/nm-setting-bridge.c
@@ -22,7 +22,6 @@
 #include <string.h>
 #include <ctype.h>
 #include <stdlib.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-bridge.h"
@@ -388,7 +387,7 @@ nm_setting_bridge_class_init (NMSettingBridgeClass *setting_class)
 		                      NM_SETTING_PARAM_INFERRABLE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_BRIDGE_MAC_ADDRESS,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 
@@ -478,7 +477,8 @@ nm_setting_bridge_class_init (NMSettingBridgeClass *setting_class)
 		                    NM_SETTING_PARAM_INFERRABLE |
 		                    G_PARAM_STATIC_STRINGS));
 
-	_nm_setting_class_add_dbus_only_property (parent_class, "interface-name", G_TYPE_STRING,
+	_nm_setting_class_add_dbus_only_property (parent_class, "interface-name",
+	                                          G_VARIANT_TYPE_STRING,
 	                                          _nm_setting_get_deprecated_virtual_interface_name,
 	                                          NULL);
 }
diff --git a/libnm-core/nm-setting-connection.c b/libnm-core/nm-setting-connection.c
index 200b9a7cd7..e6b537122a 100644
--- a/libnm-core/nm-setting-connection.c
+++ b/libnm-core/nm-setting-connection.c
@@ -949,35 +949,34 @@ verify (NMSetting *setting, GSList *all_settings, GError **error)
 }
 
 static const char *
-find_virtual_interface_name (GHashTable *connection_hash)
+find_virtual_interface_name (GVariant *connection_dict)
 {
-	GHashTable *setting_hash;
-	GValue *value;
-
-	setting_hash = g_hash_table_lookup (connection_hash, NM_SETTING_BOND_SETTING_NAME);
-	if (!setting_hash)
-		setting_hash = g_hash_table_lookup (connection_hash, NM_SETTING_BRIDGE_SETTING_NAME);
-	if (!setting_hash)
-		setting_hash = g_hash_table_lookup (connection_hash, NM_SETTING_TEAM_SETTING_NAME);
-	if (!setting_hash)
-		setting_hash = g_hash_table_lookup (connection_hash, NM_SETTING_VLAN_SETTING_NAME);
-
-	if (!setting_hash)
+	GVariant *setting_dict;
+	const char *interface_name;
+
+	setting_dict = g_variant_lookup_value (connection_dict, NM_SETTING_BOND_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+	if (!setting_dict)
+		setting_dict = g_variant_lookup_value (connection_dict, NM_SETTING_BRIDGE_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+	if (!setting_dict)
+		setting_dict = g_variant_lookup_value (connection_dict, NM_SETTING_TEAM_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+	if (!setting_dict)
+		setting_dict = g_variant_lookup_value (connection_dict, NM_SETTING_VLAN_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+
+	if (!setting_dict)
 		return NULL;
 
 	/* All of the deprecated virtual interface name properties were named "interface-name". */
-	value = g_hash_table_lookup (setting_hash, "interface-name");
-	if (!value || !G_VALUE_HOLDS_STRING (value))
+	if (!g_variant_lookup (setting_dict, "interface-name", "&s", &interface_name))
 		return NULL;
 
-	return g_value_get_string (value);
+	return interface_name;
 }
 
 static void
 nm_setting_connection_set_interface_name (NMSetting *setting,
-                                          GHashTable *connection_hash,
+                                          GVariant *connection_dict,
                                           const char *property,
-                                          const GValue *value)
+                                          GVariant *value)
 {
 	const char *interface_name;
 
@@ -985,9 +984,9 @@ nm_setting_connection_set_interface_name (NMSetting *setting,
 	 * we need to make verification fail, even if that virtual name would be
 	 * overridden by a valid connection.interface-name.
 	 */
-	interface_name = find_virtual_interface_name (connection_hash);
+	interface_name = find_virtual_interface_name (connection_dict);
 	if (!interface_name || nm_utils_iface_valid_name (interface_name))
-		interface_name = g_value_get_string (value);
+		interface_name = g_variant_get_string (value, NULL);
 
 	g_object_set (G_OBJECT (setting),
 	              NM_SETTING_CONNECTION_INTERFACE_NAME, interface_name,
@@ -996,12 +995,12 @@ nm_setting_connection_set_interface_name (NMSetting *setting,
 
 static void
 nm_setting_connection_no_interface_name (NMSetting *setting,
-                                         GHashTable *connection_hash,
+                                         GVariant *connection_dict,
                                          const char *property)
 {
 	const char *virtual_interface_name;
 
-	virtual_interface_name = find_virtual_interface_name (connection_hash);
+	virtual_interface_name = find_virtual_interface_name (connection_dict);
 	g_object_set (G_OBJECT (setting),
 	              NM_SETTING_CONNECTION_INTERFACE_NAME, virtual_interface_name,
 	              NULL);
@@ -1271,7 +1270,7 @@ nm_setting_connection_class_init (NMSettingConnectionClass *setting_class)
 		                      NM_SETTING_PARAM_INFERRABLE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_override_property (parent_class, NM_SETTING_CONNECTION_INTERFACE_NAME,
-	                                     G_TYPE_STRING,
+	                                     G_VARIANT_TYPE_STRING,
 	                                     NULL,
 	                                     nm_setting_connection_set_interface_name,
 	                                     nm_setting_connection_no_interface_name);
diff --git a/libnm-core/nm-setting-dcb.c b/libnm-core/nm-setting-dcb.c
index 67955b5809..8943db6b8f 100644
--- a/libnm-core/nm-setting-dcb.c
+++ b/libnm-core/nm-setting-dcb.c
@@ -20,13 +20,11 @@
  */
 
 #include <string.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-dcb.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-setting-private.h"
 
 /**
@@ -777,23 +775,23 @@ set_gvalue_from_array (GValue *v, uint *a, size_t len)
 
 #define SET_GVALUE_FROM_ARRAY(v, a) set_gvalue_from_array (v, a, G_N_ELEMENTS (a))
 
-static void
-_nm_setting_dcb_uint_array_to_dbus (const GValue *prop_value,
-                                    GValue *dbus_value)
+static GVariant *
+_nm_setting_dcb_uint_array_to_dbus (const GValue *prop_value)
 {
 	GArray *src = g_value_get_boxed (prop_value);
 
-	set_gvalue_from_array (dbus_value, (guint *) src->data, src->len);
+	return g_variant_new_fixed_array (G_VARIANT_TYPE_UINT32, src->data, src->len, sizeof (guint32));
 }
 
 static void
-_nm_setting_dcb_uint_array_from_dbus (const GValue *dbus_value,
+_nm_setting_dcb_uint_array_from_dbus (GVariant *dbus_value,
                                       GValue *prop_value)
 {
-	GArray *src = g_value_get_boxed (dbus_value);
-
-	set_gvalue_from_array (prop_value, (guint *) src->data, src->len);
+	gconstpointer array;
+	gsize length;
 
+	array = g_variant_get_fixed_array (dbus_value, &length, sizeof (guint32));
+	set_gvalue_from_array (prop_value, (guint *) array, length);
 }
 
 static void
@@ -1058,7 +1056,7 @@ nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_DCB_PRIORITY_FLOW_CONTROL,
-	                                      DBUS_TYPE_G_UINT_ARRAY,
+	                                      G_VARIANT_TYPE ("au"),
 	                                      _nm_setting_dcb_uint_array_to_dbus,
 	                                      _nm_setting_dcb_uint_array_from_dbus);
 
@@ -1092,7 +1090,7 @@ nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_DCB_PRIORITY_GROUP_ID,
-	                                      DBUS_TYPE_G_UINT_ARRAY,
+	                                      G_VARIANT_TYPE ("au"),
 	                                      _nm_setting_dcb_uint_array_to_dbus,
 	                                      _nm_setting_dcb_uint_array_from_dbus);
 
@@ -1113,7 +1111,7 @@ nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_DCB_PRIORITY_GROUP_BANDWIDTH,
-	                                      DBUS_TYPE_G_UINT_ARRAY,
+	                                      G_VARIANT_TYPE ("au"),
 	                                      _nm_setting_dcb_uint_array_to_dbus,
 	                                      _nm_setting_dcb_uint_array_from_dbus);
 
@@ -1135,7 +1133,7 @@ nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_DCB_PRIORITY_BANDWIDTH,
-	                                      DBUS_TYPE_G_UINT_ARRAY,
+	                                      G_VARIANT_TYPE ("au"),
 	                                      _nm_setting_dcb_uint_array_to_dbus,
 	                                      _nm_setting_dcb_uint_array_from_dbus);
 
@@ -1155,7 +1153,7 @@ nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_DCB_PRIORITY_STRICT_BANDWIDTH,
-	                                      DBUS_TYPE_G_UINT_ARRAY,
+	                                      G_VARIANT_TYPE ("au"),
 	                                      _nm_setting_dcb_uint_array_to_dbus,
 	                                      _nm_setting_dcb_uint_array_from_dbus);
 
@@ -1175,7 +1173,7 @@ nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_DCB_PRIORITY_TRAFFIC_CLASS,
-	                                      DBUS_TYPE_G_UINT_ARRAY,
+	                                      G_VARIANT_TYPE ("au"),
 	                                      _nm_setting_dcb_uint_array_to_dbus,
 	                                      _nm_setting_dcb_uint_array_from_dbus);
 }
diff --git a/libnm-core/nm-setting-gsm.c b/libnm-core/nm-setting-gsm.c
index 70f0501e8d..3d497f7540 100644
--- a/libnm-core/nm-setting-gsm.c
+++ b/libnm-core/nm-setting-gsm.c
@@ -625,9 +625,9 @@ nm_setting_gsm_class_init (NMSettingGsmClass *setting_class)
 
 	/* Ignore incoming deprecated properties */
 	_nm_setting_class_add_dbus_only_property (parent_class, "allowed-bands",
-	                                          G_TYPE_UINT,
+	                                          G_VARIANT_TYPE_UINT32,
 	                                          NULL, NULL);
 	_nm_setting_class_add_dbus_only_property (parent_class, "network-type",
-	                                          G_TYPE_INT,
+	                                          G_VARIANT_TYPE_INT32,
 	                                          NULL, NULL);
 }
diff --git a/libnm-core/nm-setting-infiniband.c b/libnm-core/nm-setting-infiniband.c
index a5bbf92664..6c8d31e23c 100644
--- a/libnm-core/nm-setting-infiniband.c
+++ b/libnm-core/nm-setting-infiniband.c
@@ -20,7 +20,6 @@
  */
 
 #include <stdlib.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-infiniband.h"
@@ -419,7 +418,7 @@ nm_setting_infiniband_class_init (NMSettingInfinibandClass *setting_class)
 		                      NM_SETTING_PARAM_INFERRABLE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_INFINIBAND_MAC_ADDRESS,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 
diff --git a/libnm-core/nm-setting-ip4-config.c b/libnm-core/nm-setting-ip4-config.c
index ef31832dc2..ba31bcedb6 100644
--- a/libnm-core/nm-setting-ip4-config.c
+++ b/libnm-core/nm-setting-ip4-config.c
@@ -21,12 +21,10 @@
  */
 
 #include <string.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-ip4-config.h"
 #include "nm-utils.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-glib-compat.h"
 #include "nm-setting-private.h"
 #include "nm-core-internal.h"
@@ -1095,6 +1093,45 @@ finalize (GObject *object)
 	G_OBJECT_CLASS (nm_setting_ip4_config_parent_class)->finalize (object);
 }
 
+static GVariant *
+ip4_dns_to_dbus (const GValue *prop_value)
+{
+	return nm_utils_ip4_dns_to_variant (g_value_get_boxed (prop_value));
+}
+
+static void
+ip4_dns_from_dbus (GVariant *dbus_value,
+                   GValue *prop_value)
+{
+	g_value_take_boxed (prop_value, nm_utils_ip4_dns_from_variant (dbus_value));
+}
+
+static GVariant *
+ip4_addresses_to_dbus (const GValue *prop_value)
+{
+	return nm_utils_ip4_addresses_to_variant (g_value_get_boxed (prop_value));
+}
+
+static void
+ip4_addresses_from_dbus (GVariant *dbus_value,
+                         GValue *prop_value)
+{
+	g_value_take_boxed (prop_value, nm_utils_ip4_addresses_from_variant (dbus_value));
+}
+
+static GVariant *
+ip4_routes_to_dbus (const GValue *prop_value)
+{
+	return nm_utils_ip4_routes_to_variant (g_value_get_boxed (prop_value));
+}
+
+static void
+ip4_routes_from_dbus (GVariant *dbus_value,
+                      GValue *prop_value)
+{
+	g_value_take_boxed (prop_value, nm_utils_ip4_routes_from_variant (dbus_value));
+}
+
 static void
 set_property (GObject *object, guint prop_id,
               const GValue *value, GParamSpec *pspec)
@@ -1275,9 +1312,9 @@ nm_setting_ip4_config_class_init (NMSettingIP4ConfigClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_IP4_CONFIG_DNS,
-	                                      DBUS_TYPE_G_UINT_ARRAY,
-	                                      _nm_utils_ip4_dns_to_dbus,
-	                                      _nm_utils_ip4_dns_from_dbus);
+	                                      G_VARIANT_TYPE ("au"),
+	                                      ip4_dns_to_dbus,
+	                                      ip4_dns_from_dbus);
 
 	/**
 	 * NMSettingIP4Config:dns-search:
@@ -1314,9 +1351,9 @@ nm_setting_ip4_config_class_init (NMSettingIP4ConfigClass *setting_class)
 		                     NM_SETTING_PARAM_INFERRABLE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_IP4_CONFIG_ADDRESSES,
-	                                      DBUS_TYPE_G_ARRAY_OF_ARRAY_OF_UINT,
-	                                      _nm_utils_ip4_addresses_to_dbus,
-	                                      _nm_utils_ip4_addresses_from_dbus);
+	                                      G_VARIANT_TYPE ("aau"),
+	                                      ip4_addresses_to_dbus,
+	                                      ip4_addresses_from_dbus);
 
 	/**
 	 * NMSettingIP4Config:address-labels:
@@ -1349,9 +1386,9 @@ nm_setting_ip4_config_class_init (NMSettingIP4ConfigClass *setting_class)
 		                     NM_SETTING_PARAM_INFERRABLE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_IP4_CONFIG_ROUTES,
-	                                      DBUS_TYPE_G_ARRAY_OF_ARRAY_OF_UINT,
-	                                      _nm_utils_ip4_routes_to_dbus,
-	                                      _nm_utils_ip4_routes_from_dbus);
+	                                      G_VARIANT_TYPE ("aau"),
+	                                      ip4_routes_to_dbus,
+	                                      ip4_routes_from_dbus);
 
 	/**
 	 * NMSettingIP4Config:ignore-auto-routes:
diff --git a/libnm-core/nm-setting-ip6-config.c b/libnm-core/nm-setting-ip6-config.c
index 6c085404d0..81e04dbf37 100644
--- a/libnm-core/nm-setting-ip6-config.c
+++ b/libnm-core/nm-setting-ip6-config.c
@@ -20,13 +20,11 @@
  */
 
 #include <string.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-ip6-config.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-glib-compat.h"
 #include "nm-setting-private.h"
 
@@ -923,6 +921,45 @@ finalize (GObject *object)
 	G_OBJECT_CLASS (nm_setting_ip6_config_parent_class)->finalize (object);
 }
 
+static GVariant *
+ip6_dns_to_dbus (const GValue *prop_value)
+{
+	return nm_utils_ip6_dns_to_variant (g_value_get_boxed (prop_value));
+}
+
+static void
+ip6_dns_from_dbus (GVariant *dbus_value,
+                   GValue *prop_value)
+{
+	g_value_take_boxed (prop_value, nm_utils_ip6_dns_from_variant (dbus_value));
+}
+
+static GVariant *
+ip6_addresses_to_dbus (const GValue *prop_value)
+{
+	return nm_utils_ip6_addresses_to_variant (g_value_get_boxed (prop_value));
+}
+
+static void
+ip6_addresses_from_dbus (GVariant *dbus_value,
+                         GValue *prop_value)
+{
+	g_value_take_boxed (prop_value, nm_utils_ip6_addresses_from_variant (dbus_value));
+}
+
+static GVariant *
+ip6_routes_to_dbus (const GValue *prop_value)
+{
+	return nm_utils_ip6_routes_to_variant (g_value_get_boxed (prop_value));
+}
+
+static void
+ip6_routes_from_dbus (GVariant *dbus_value,
+                      GValue *prop_value)
+{
+	g_value_take_boxed (prop_value, nm_utils_ip6_routes_from_variant (dbus_value));
+}
+
 static void
 set_property (GObject *object, guint prop_id,
               const GValue *value, GParamSpec *pspec)
@@ -1090,9 +1127,9 @@ nm_setting_ip6_config_class_init (NMSettingIP6ConfigClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_IP6_CONFIG_DNS,
-	                                      DBUS_TYPE_G_ARRAY_OF_ARRAY_OF_UCHAR,
-	                                      _nm_utils_ip6_dns_to_dbus,
-	                                      _nm_utils_ip6_dns_from_dbus);
+	                                      G_VARIANT_TYPE ("aay"),
+	                                      ip6_dns_to_dbus,
+	                                      ip6_dns_from_dbus);
 
 	/**
 	 * NMSettingIP6Config:dns-search:
@@ -1128,9 +1165,9 @@ nm_setting_ip6_config_class_init (NMSettingIP6ConfigClass *setting_class)
 		                     NM_SETTING_PARAM_INFERRABLE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_IP6_CONFIG_ADDRESSES,
-	                                      DBUS_TYPE_G_ARRAY_OF_IP6_ADDRESS,
-	                                      _nm_utils_ip6_addresses_to_dbus,
-	                                      _nm_utils_ip6_addresses_from_dbus);
+	                                      G_VARIANT_TYPE ("a(ayuay)"),
+	                                      ip6_addresses_to_dbus,
+	                                      ip6_addresses_from_dbus);
 
 	/**
 	 * NMSettingIP6Config:routes:
@@ -1149,9 +1186,9 @@ nm_setting_ip6_config_class_init (NMSettingIP6ConfigClass *setting_class)
 		                     NM_SETTING_PARAM_INFERRABLE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_IP6_CONFIG_ROUTES,
-	                                      DBUS_TYPE_G_ARRAY_OF_IP6_ROUTE,
-	                                      _nm_utils_ip6_routes_to_dbus,
-	                                      _nm_utils_ip6_routes_from_dbus);
+	                                      G_VARIANT_TYPE ("a(ayuayu)"),
+	                                      ip6_routes_to_dbus,
+	                                      ip6_routes_from_dbus);
 
 	/**
 	 * NMSettingIP6Config:ignore-auto-routes:
diff --git a/libnm-core/nm-setting-olpc-mesh.c b/libnm-core/nm-setting-olpc-mesh.c
index 378aa044da..2d5967c6d2 100644
--- a/libnm-core/nm-setting-olpc-mesh.c
+++ b/libnm-core/nm-setting-olpc-mesh.c
@@ -21,13 +21,11 @@
  */
 
 #include <string.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-olpc-mesh.h"
 #include "nm-dbus-interface.h"
 #include "nm-utils.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-utils-private.h"
 #include "nm-setting-private.h"
 
@@ -239,7 +237,7 @@ nm_setting_olpc_mesh_class_init (NMSettingOlpcMeshClass *setting_class)
 		                     NM_SETTING_PARAM_INFERRABLE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_OLPC_MESH_SSID,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
@@ -271,7 +269,7 @@ nm_setting_olpc_mesh_class_init (NMSettingOlpcMeshClass *setting_class)
 		                      G_PARAM_READWRITE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_OLPC_MESH_DHCP_ANYCAST_ADDRESS,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 }
diff --git a/libnm-core/nm-setting-private.h b/libnm-core/nm-setting-private.h
index e7c141a05d..f277992481 100644
--- a/libnm-core/nm-setting-private.h
+++ b/libnm-core/nm-setting-private.h
@@ -66,7 +66,7 @@ typedef enum NMSettingUpdateSecretResult {
 } NMSettingUpdateSecretResult;
 
 NMSettingUpdateSecretResult _nm_setting_update_secrets (NMSetting *setting,
-                                                        GHashTable *secrets,
+                                                        GVariant *secrets,
                                                         GError **error);
 gboolean _nm_setting_clear_secrets (NMSetting *setting);
 gboolean _nm_setting_clear_secrets_with_flags (NMSetting *setting,
@@ -104,10 +104,9 @@ NMSetting * _nm_setting_find_in_list_required (GSList *all_settings,
 NMSettingVerifyResult _nm_setting_verify_required_virtual_interface_name (GSList *all_settings,
                                                                           GError **error);
 
-gboolean _nm_setting_get_deprecated_virtual_interface_name (NMSetting *setting,
-                                                            NMConnection *connection,
-                                                            const char *property,
-                                                            GValue *value);
+GVariant *_nm_setting_get_deprecated_virtual_interface_name (NMSetting *setting,
+                                                             NMConnection *connection,
+                                                             const char *property);
 
 NMSettingVerifyResult _nm_setting_verify (NMSetting *setting,
                                           GSList    *all_settings,
@@ -117,47 +116,46 @@ NMSetting *_nm_setting_find_in_list_base_type (GSList *all_settings);
 gboolean _nm_setting_slave_type_is_valid (const char *slave_type, const char **out_port_type);
 const char * _nm_setting_slave_type_detect_from_settings (GSList *all_settings, NMSetting **out_s_port);
 
-GHashTable *_nm_setting_to_dbus       (NMSetting *setting,
+GVariant   *_nm_setting_to_dbus       (NMSetting *setting,
                                        NMConnection *connection,
                                        NMConnectionSerializationFlags flags);
 
 NMSetting  *_nm_setting_new_from_dbus (GType setting_type,
-                                       GHashTable *setting_hash,
-                                       GHashTable *connection_hash,
+                                       GVariant *setting_dict,
+                                       GVariant *connection_dict,
                                        GError **error);
 
-typedef gboolean (*NMSettingPropertyGetFunc)    (NMSetting     *setting,
-                                                 NMConnection  *connection,
-                                                 const char    *property,
-                                                 GValue        *value);
-typedef void     (*NMSettingPropertySetFunc)    (NMSetting     *setting,
-                                                 GHashTable    *connection_hash,
-                                                 const char    *property,
-                                                 const GValue  *value);
-typedef void     (*NMSettingPropertyNotSetFunc) (NMSetting     *setting,
-                                                 GHashTable    *connection_hash,
-                                                 const char    *property);
+typedef GVariant * (*NMSettingPropertyGetFunc)    (NMSetting     *setting,
+                                                   NMConnection  *connection,
+                                                   const char    *property);
+typedef void       (*NMSettingPropertySetFunc)    (NMSetting     *setting,
+                                                   GVariant      *connection_dict,
+                                                   const char    *property,
+                                                   GVariant      *value);
+typedef void       (*NMSettingPropertyNotSetFunc) (NMSetting     *setting,
+                                                   GVariant      *connection_dict,
+                                                   const char    *property);
 
 void _nm_setting_class_add_dbus_only_property (NMSettingClass *setting_class,
                                                const char *property_name,
-                                               GType dbus_type,
+                                               const GVariantType *dbus_type,
                                                NMSettingPropertyGetFunc get_func,
                                                NMSettingPropertySetFunc set_func);
 
 void _nm_setting_class_override_property (NMSettingClass *setting_class,
                                           const char *property_name,
-                                          GType dbus_type,
+                                          const GVariantType *dbus_type,
                                           NMSettingPropertyGetFunc get_func,
                                           NMSettingPropertySetFunc set_func,
                                           NMSettingPropertyNotSetFunc not_set_func);
 
-typedef void (*NMSettingPropertyTransformFunc) (const GValue *from,
-                                                GValue       *to);
+typedef GVariant * (*NMSettingPropertyTransformToFunc) (const GValue *from);
+typedef void (*NMSettingPropertyTransformFromFunc) (GVariant *from, GValue *to);
 
 void _nm_setting_class_transform_property (NMSettingClass *setting_class,
                                            const char *property_name,
-                                           GType dbus_type,
-                                           NMSettingPropertyTransformFunc to_dbus,
-                                           NMSettingPropertyTransformFunc from_dbus);
+                                           const GVariantType *dbus_type,
+                                           NMSettingPropertyTransformToFunc to_dbus,
+                                           NMSettingPropertyTransformFromFunc from_dbus);
 
 #endif  /* NM_SETTING_PRIVATE_H */
diff --git a/libnm-core/nm-setting-team-port.c b/libnm-core/nm-setting-team-port.c
index cbed8de48f..1e04d68c69 100644
--- a/libnm-core/nm-setting-team-port.c
+++ b/libnm-core/nm-setting-team-port.c
@@ -21,7 +21,6 @@
 #include <string.h>
 #include <ctype.h>
 #include <stdlib.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-team-port.h"
diff --git a/libnm-core/nm-setting-team.c b/libnm-core/nm-setting-team.c
index 8fb94c3992..cb41e6f0a5 100644
--- a/libnm-core/nm-setting-team.c
+++ b/libnm-core/nm-setting-team.c
@@ -20,13 +20,11 @@
 
 #include <string.h>
 #include <stdlib.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-team.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-setting-private.h"
 
 /**
@@ -183,7 +181,8 @@ nm_setting_team_class_init (NMSettingTeamClass *setting_class)
 		                      NM_SETTING_PARAM_INFERRABLE |
 		                      G_PARAM_STATIC_STRINGS));
 
-	_nm_setting_class_add_dbus_only_property (parent_class, "interface-name", G_TYPE_STRING,
+	_nm_setting_class_add_dbus_only_property (parent_class, "interface-name",
+	                                          G_VARIANT_TYPE_STRING,
 	                                          _nm_setting_get_deprecated_virtual_interface_name,
 	                                          NULL);
 }
diff --git a/libnm-core/nm-setting-vlan.c b/libnm-core/nm-setting-vlan.c
index 55262264b2..e043518615 100644
--- a/libnm-core/nm-setting-vlan.c
+++ b/libnm-core/nm-setting-vlan.c
@@ -777,7 +777,8 @@ nm_setting_vlan_class_init (NMSettingVlanClass *setting_class)
 		                     NM_SETTING_PARAM_INFERRABLE |
 		                     G_PARAM_STATIC_STRINGS));
 
-	_nm_setting_class_add_dbus_only_property (parent_class, "interface-name", G_TYPE_STRING,
+	_nm_setting_class_add_dbus_only_property (parent_class, "interface-name",
+	                                          G_VARIANT_TYPE_STRING,
 	                                          _nm_setting_get_deprecated_virtual_interface_name,
 	                                          NULL);
 }
diff --git a/libnm-core/nm-setting-vpn.c b/libnm-core/nm-setting-vpn.c
index 30a4893d31..6ce4145029 100644
--- a/libnm-core/nm-setting-vpn.c
+++ b/libnm-core/nm-setting-vpn.c
@@ -22,13 +22,11 @@
 #include <string.h>
 #include <errno.h>
 #include <stdlib.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-vpn.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-setting-private.h"
 
 /**
@@ -448,20 +446,20 @@ update_secret_string (NMSetting *setting,
 }
 
 static NMSettingUpdateSecretResult
-update_secret_hash (NMSetting *setting,
-                    GHashTable *secrets,
+update_secret_dict (NMSetting *setting,
+                    GVariant *secrets,
                     GError **error)
 {
 	NMSettingVpnPrivate *priv = NM_SETTING_VPN_GET_PRIVATE (setting);
-	GHashTableIter iter;
+	GVariantIter iter;
 	const char *name, *value;
 	NMSettingUpdateSecretResult result = NM_SETTING_UPDATE_SECRET_SUCCESS_UNCHANGED;
 
 	g_return_val_if_fail (secrets != NULL, NM_SETTING_UPDATE_SECRET_ERROR);
 
 	/* Make sure the items are valid */
-	g_hash_table_iter_init (&iter, secrets);
-	while (g_hash_table_iter_next (&iter, (gpointer *) &name, (gpointer *) &value)) {
+	g_variant_iter_init (&iter, secrets);
+	while (g_variant_iter_next (&iter, "{&s&s}", &name, &value)) {
 		if (!name || !strlen (name)) {
 			g_set_error_literal (error, NM_SETTING_ERROR,
 			                     NM_SETTING_ERROR_PROPERTY_TYPE_MISMATCH,
@@ -478,8 +476,8 @@ update_secret_hash (NMSetting *setting,
 	}
 
 	/* Now add the items to the settings' secrets list */
-	g_hash_table_iter_init (&iter, secrets);
-	while (g_hash_table_iter_next (&iter, (gpointer *) &name, (gpointer *) &value)) {
+	g_variant_iter_init (&iter, secrets);
+	while (g_variant_iter_next (&iter, "{&s&s}", &name, &value)) {
 		if (value == NULL) {
 			g_warn_if_fail (value != NULL);
 			continue;
@@ -500,26 +498,26 @@ update_secret_hash (NMSetting *setting,
 }
 
 static int
-update_one_secret (NMSetting *setting, const char *key, GValue *value, GError **error)
+update_one_secret (NMSetting *setting, const char *key, GVariant *value, GError **error)
 {
 	NMSettingUpdateSecretResult success = NM_SETTING_UPDATE_SECRET_ERROR;
 
 	g_return_val_if_fail (key != NULL, NM_SETTING_UPDATE_SECRET_ERROR);
 	g_return_val_if_fail (value != NULL, NM_SETTING_UPDATE_SECRET_ERROR);
 
-	if (G_VALUE_HOLDS_STRING (value)) {
+	if (g_variant_is_of_type (value, G_VARIANT_TYPE_STRING)) {
 		/* Passing the string properties individually isn't correct, and won't
 		 * produce the correct result, but for some reason that's how it used
 		 * to be done.  So even though it's not correct, keep the code around
 		 * for compatibility's sake.
 		 */
-		success = update_secret_string (setting, key, g_value_get_string (value), error);
-	} else if (G_VALUE_HOLDS (value, DBUS_TYPE_G_MAP_OF_STRING)) {
+		success = update_secret_string (setting, key, g_variant_get_string (value, NULL), error);
+	} else if (g_variant_is_of_type (value, G_VARIANT_TYPE ("a{ss}"))) {
 		if (strcmp (key, NM_SETTING_VPN_SECRETS) != 0) {
 			g_set_error (error, NM_SETTING_ERROR, NM_SETTING_ERROR_PROPERTY_NOT_SECRET,
 			             "Property %s not a secret property", key);
 		} else
-			success = update_secret_hash (setting, g_value_get_boxed (value), error);
+			success = update_secret_dict (setting, value, error);
 	} else
 		g_set_error_literal (error, NM_SETTING_ERROR, NM_SETTING_ERROR_PROPERTY_TYPE_MISMATCH, key);
 
@@ -837,7 +835,7 @@ nm_setting_vpn_class_init (NMSettingVpnClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_VPN_DATA,
-	                                      DBUS_TYPE_G_MAP_OF_STRING,
+	                                      G_VARIANT_TYPE ("a{ss}"),
 	                                      _nm_utils_strdict_to_dbus,
 	                                      _nm_utils_strdict_from_dbus);
 
@@ -857,7 +855,7 @@ nm_setting_vpn_class_init (NMSettingVpnClass *setting_class)
 		                     NM_SETTING_PARAM_SECRET |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_VPN_SECRETS,
-	                                      DBUS_TYPE_G_MAP_OF_STRING,
+	                                      G_VARIANT_TYPE ("a{ss}"),
 	                                      _nm_utils_strdict_to_dbus,
 	                                      _nm_utils_strdict_from_dbus);
 }
diff --git a/libnm-core/nm-setting-wimax.c b/libnm-core/nm-setting-wimax.c
index 467e1f617c..bcb2458d4d 100644
--- a/libnm-core/nm-setting-wimax.c
+++ b/libnm-core/nm-setting-wimax.c
@@ -22,7 +22,6 @@
 
 #include <string.h>
 #include <net/ethernet.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-wimax.h"
@@ -255,7 +254,7 @@ nm_setting_wimax_class_init (NMSettingWimaxClass *setting_class)
 		                      G_PARAM_READWRITE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_WIMAX_MAC_ADDRESS,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 }
diff --git a/libnm-core/nm-setting-wired.c b/libnm-core/nm-setting-wired.c
index f641e8a813..4338ab047e 100644
--- a/libnm-core/nm-setting-wired.c
+++ b/libnm-core/nm-setting-wired.c
@@ -22,13 +22,11 @@
 
 #include <string.h>
 #include <net/ethernet.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-wired.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-setting-private.h"
 
 /**
@@ -895,7 +893,7 @@ nm_setting_wired_class_init (NMSettingWiredClass *setting_class)
 		                      NM_SETTING_PARAM_INFERRABLE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_WIRED_MAC_ADDRESS,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 
@@ -913,7 +911,7 @@ nm_setting_wired_class_init (NMSettingWiredClass *setting_class)
 		                      NM_SETTING_PARAM_INFERRABLE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_WIRED_CLONED_MAC_ADDRESS,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 
@@ -999,7 +997,7 @@ nm_setting_wired_class_init (NMSettingWiredClass *setting_class)
 		                     NM_SETTING_PARAM_INFERRABLE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_WIRED_S390_OPTIONS,
-	                                      DBUS_TYPE_G_MAP_OF_STRING,
+	                                      G_VARIANT_TYPE ("a{ss}"),
 	                                      _nm_utils_strdict_to_dbus,
 	                                      _nm_utils_strdict_from_dbus);
 }
diff --git a/libnm-core/nm-setting-wireless.c b/libnm-core/nm-setting-wireless.c
index 600e54c0eb..17e7c3f3b5 100644
--- a/libnm-core/nm-setting-wireless.c
+++ b/libnm-core/nm-setting-wireless.c
@@ -22,13 +22,11 @@
 
 #include <string.h>
 #include <net/ethernet.h>
-#include <dbus/dbus-glib.h>
 #include <glib/gi18n.h>
 
 #include "nm-setting-wireless.h"
 #include "nm-dbus-interface.h"
 #include "nm-utils.h"
-#include "nm-dbus-glib-types.h"
 #include "nm-utils-private.h"
 #include "nm-setting-private.h"
 
@@ -820,17 +818,15 @@ verify (NMSetting *setting, GSList *all_settings, GError **error)
 	return TRUE;
 }
 
-static gboolean
+static GVariant *
 nm_setting_wireless_get_security (NMSetting    *setting,
                                   NMConnection *connection,
-                                  const char   *property_name,
-                                  GValue       *value)
+                                  const char   *property_name)
 {
-	if (nm_connection_get_setting_wireless_security (connection)) {
-		g_value_set_string (value, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
-		return TRUE;
-	} else
-		return FALSE;
+	if (nm_connection_get_setting_wireless_security (connection))
+		return g_variant_new_string (NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
+	else
+		return NULL;
 }
 
 static void
@@ -998,7 +994,7 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_WIRELESS_SSID,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_bytes_to_dbus,
 	                                      _nm_utils_bytes_from_dbus);
 
@@ -1063,7 +1059,7 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_class)
 		                      G_PARAM_READWRITE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_WIRELESS_BSSID,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 
@@ -1114,7 +1110,7 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_class)
 		                      G_PARAM_READWRITE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_WIRELESS_MAC_ADDRESS,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 
@@ -1131,7 +1127,7 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_class)
 		                      G_PARAM_READWRITE |
 		                      G_PARAM_STATIC_STRINGS));
 	_nm_setting_class_transform_property (parent_class, NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS,
-	                                      DBUS_TYPE_G_UCHAR_ARRAY,
+	                                      G_VARIANT_TYPE_BYTESTRING,
 	                                      _nm_utils_hwaddr_to_dbus,
 	                                      _nm_utils_hwaddr_from_dbus);
 
@@ -1200,6 +1196,7 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_class)
 		                       G_PARAM_STATIC_STRINGS));
 
 	/* Compatibility for deprecated property */
-	_nm_setting_class_add_dbus_only_property (parent_class, "security", G_TYPE_STRING,
+	_nm_setting_class_add_dbus_only_property (parent_class, "security",
+	                                          G_VARIANT_TYPE_STRING,
 	                                          nm_setting_wireless_get_security, NULL);
 }
diff --git a/libnm-core/nm-setting.c b/libnm-core/nm-setting.c
index 04eee75117..197b80c14f 100644
--- a/libnm-core/nm-setting.c
+++ b/libnm-core/nm-setting.c
@@ -22,6 +22,7 @@
 
 #include <string.h>
 #include <glib/gi18n.h>
+#include <gio/gio.h>
 
 #include "nm-setting.h"
 #include "nm-setting-private.h"
@@ -104,7 +105,6 @@ _ensure_registered (void)
 #if !GLIB_CHECK_VERSION (2, 35, 0)
 		g_type_init ();
 #endif
-		_nm_value_transforms_register ();
 		registered_settings = g_hash_table_new (g_str_hash, g_str_equal);
 		registered_settings_by_type = g_hash_table_new (_nm_gtype_hash, _nm_gtype_equal);
 	}
@@ -376,14 +376,14 @@ _nm_setting_slave_type_detect_from_settings (GSList *all_settings, NMSetting **o
 typedef struct {
 	const char *name;
 	GParamSpec *param_spec;
-	GType dbus_type;
+	const GVariantType *dbus_type;
 
 	NMSettingPropertyGetFunc get_func;
 	NMSettingPropertySetFunc set_func;
 	NMSettingPropertyNotSetFunc not_set_func;
 
-	NMSettingPropertyTransformFunc to_dbus;
-	NMSettingPropertyTransformFunc from_dbus;
+	NMSettingPropertyTransformToFunc to_dbus;
+	NMSettingPropertyTransformFromFunc from_dbus;
 } NMSettingProperty;
 
 static GQuark setting_property_overrides_quark;
@@ -411,12 +411,12 @@ static void
 add_property_override (NMSettingClass *setting_class,
                        const char *property_name,
                        GParamSpec *param_spec,
-                       GType dbus_type,
+                       const GVariantType *dbus_type,
                        NMSettingPropertyGetFunc get_func,
                        NMSettingPropertySetFunc set_func,
                        NMSettingPropertyNotSetFunc not_set_func,
-                       NMSettingPropertyTransformFunc to_dbus,
-                       NMSettingPropertyTransformFunc from_dbus)
+                       NMSettingPropertyTransformToFunc to_dbus,
+                       NMSettingPropertyTransformFromFunc from_dbus)
 {
 	GType setting_type = G_TYPE_FROM_CLASS (setting_class);
 	GArray *overrides;
@@ -448,7 +448,7 @@ add_property_override (NMSettingClass *setting_class,
  * _nm_setting_class_add_dbus_only_property:
  * @setting_class: the setting class
  * @property_name: the name of the property to override
- * @dbus_type: the type of the property
+ * @dbus_type: the type of the property (in its D-Bus representation)
  * @get_func: (allow-none): function to call to get the value of the property
  * @set_func: (allow-none): function to call to set the value of the property
  *
@@ -457,9 +457,9 @@ add_property_override (NMSettingClass *setting_class,
  * a #GObject property.
  *
  * When serializing a setting to D-Bus, @get_func will be called to get the
- * property's value. If it returns %TRUE, the value will be added to the hash,
- * and if %FALSE, it will not. (If @get_func is %NULL, the property will always
- * be omitted in the serialization.)
+ * property's value. (If it returns %NULL, no value will be added to the
+ * serialization. If @get_func is %NULL, the property will always be omitted in
+ * the serialization.)
  *
  * When deserializing a D-Bus representation into a setting, if @property_name
  * is present, then @set_func will be called to set (and/or verify) it. If it
@@ -471,7 +471,7 @@ add_property_override (NMSettingClass *setting_class,
 void
 _nm_setting_class_add_dbus_only_property (NMSettingClass *setting_class,
                                           const char *property_name,
-                                          GType dbus_type,
+                                          const GVariantType *dbus_type,
                                           NMSettingPropertyGetFunc get_func,
                                           NMSettingPropertySetFunc set_func)
 {
@@ -520,7 +520,7 @@ _nm_setting_class_add_dbus_only_property (NMSettingClass *setting_class,
 void
 _nm_setting_class_override_property (NMSettingClass *setting_class,
                                      const char *property_name,
-                                     GType dbus_type,
+                                     const GVariantType *dbus_type,
                                      NMSettingPropertyGetFunc get_func,
                                      NMSettingPropertySetFunc set_func,
                                      NMSettingPropertyNotSetFunc not_set_func)
@@ -555,9 +555,9 @@ _nm_setting_class_override_property (NMSettingClass *setting_class,
 void
 _nm_setting_class_transform_property (NMSettingClass *setting_class,
                                       const char *property,
-                                      GType dbus_type,
-                                      NMSettingPropertyTransformFunc to_dbus,
-                                      NMSettingPropertyTransformFunc from_dbus)
+                                      const GVariantType *dbus_type,
+                                      NMSettingPropertyTransformToFunc to_dbus,
+                                      NMSettingPropertyTransformFromFunc from_dbus)
 {
 	GParamSpec *param_spec;
 
@@ -643,33 +643,90 @@ nm_setting_class_find_property (NMSettingClass *setting_class, const char *prope
 
 /*************************************************************/
 
+static const GVariantType *
+variant_type_for_gtype (GType type)
+{
+	if (type == G_TYPE_BOOLEAN)
+		return G_VARIANT_TYPE_BOOLEAN;
+	else if (type == G_TYPE_UCHAR)
+		return G_VARIANT_TYPE_BYTE;
+	else if (type == G_TYPE_INT)
+		return G_VARIANT_TYPE_INT32;
+	else if (type == G_TYPE_UINT)
+		return G_VARIANT_TYPE_UINT32;
+	else if (type == G_TYPE_INT64)
+		return G_VARIANT_TYPE_INT64;
+	else if (type == G_TYPE_UINT64)
+		return G_VARIANT_TYPE_UINT64;
+	else if (type == G_TYPE_STRING)
+		return G_VARIANT_TYPE_STRING;
+	else if (type == G_TYPE_DOUBLE)
+		return G_VARIANT_TYPE_DOUBLE;
+	else if (type == G_TYPE_STRV)
+		return G_VARIANT_TYPE_STRING_ARRAY;
+	else
+		g_assert_not_reached ();
+}
+
+static GVariant *
+get_property_for_dbus (NMSetting *setting,
+                       const NMSettingProperty *property,
+                       gboolean ignore_default)
+{
+	GValue prop_value = { 0, };
+	GVariant *dbus_value;
+
+	g_return_val_if_fail (property->param_spec != NULL, NULL);
+
+	g_value_init (&prop_value, property->param_spec->value_type);
+	g_object_get_property (G_OBJECT (setting), property->param_spec->name, &prop_value);
+
+	if (ignore_default && g_param_value_defaults (property->param_spec, &prop_value)) {
+		g_value_unset (&prop_value);
+		return NULL;
+	}
+
+	if (property->to_dbus)
+		dbus_value = property->to_dbus (&prop_value);
+	else if (property->dbus_type)
+		dbus_value = g_dbus_gvalue_to_gvariant (&prop_value, property->dbus_type);
+	else
+		dbus_value = g_dbus_gvalue_to_gvariant (&prop_value, variant_type_for_gtype (prop_value.g_type));
+	g_value_unset (&prop_value);
+
+	return dbus_value;
+}
+
 static void
-destroy_gvalue (gpointer data)
+set_property_from_dbus (const NMSettingProperty *property, GVariant *src_value, GValue *dst_value)
 {
-	GValue *value = (GValue *) data;
+	g_return_val_if_fail (property->param_spec != NULL, NULL);
 
-	if (G_IS_VALUE (value))
-		g_value_unset (value);
-	g_slice_free (GValue, value);
+	if (property->from_dbus)
+		property->from_dbus (src_value, dst_value);
+	else
+		g_dbus_gvariant_to_gvalue (src_value, dst_value);
 }
 
+
 /**
  * _nm_setting_to_dbus:
  * @setting: the #NMSetting
  * @connection: the #NMConnection containing @setting
  * @flags: hash flags, e.g. %NM_CONNECTION_SERIALIZE_ALL
  *
- * Converts the #NMSetting into a #GHashTable mapping each setting property
- * name to a GValue describing that property, suitable for marshalling over
- * D-Bus or serializing.  The mapping is string to GValue.
+ * Converts the #NMSetting into a #GVariant of type #NM_VARIANT_TYPE_SETTING
+ * mapping each setting property name to a value describing that property,
+ * suitable for marshalling over D-Bus or serializing.
  *
- * Returns: (transfer full) (element-type utf8 GObject.Value): a new #GHashTable
- * describing the setting's properties
+ * Returns: (transfer none): a new floating #GVariant describing the setting's
+ * properties
  **/
-GHashTable *
+GVariant *
 _nm_setting_to_dbus (NMSetting *setting, NMConnection *connection, NMConnectionSerializationFlags flags)
 {
-	GHashTable *hash;
+	GVariantBuilder builder;
+	GVariant *dbus_value;
 	const NMSettingProperty *properties;
 	guint n_properties, i;
 
@@ -677,14 +734,11 @@ _nm_setting_to_dbus (NMSetting *setting, NMConnection *connection, NMConnectionS
 
 	properties = nm_setting_class_get_properties (NM_SETTING_GET_CLASS (setting), &n_properties);
 
-	hash = g_hash_table_new_full (g_str_hash, g_str_equal,
-	                              (GDestroyNotify) g_free, destroy_gvalue);
+	g_variant_builder_init (&builder, NM_VARIANT_TYPE_SETTING);
 
 	for (i = 0; i < n_properties; i++) {
 		const NMSettingProperty *property = &properties[i];
 		GParamSpec *prop_spec = property->param_spec;
-		GValue *value;
-		gboolean set;
 
 		if (!prop_spec && !property->get_func) {
 			/* Override property with no get_func, so we skip it. */
@@ -702,73 +756,65 @@ _nm_setting_to_dbus (NMSetting *setting, NMConnection *connection, NMConnectionS
 		    && !(prop_spec && (prop_spec->flags & NM_SETTING_PARAM_SECRET)))
 			continue;
 
-		value = g_slice_new0 (GValue);
-		if (property->get_func) {
-			g_value_init (value, property->dbus_type);
-			set = property->get_func (setting, connection, property->name, value);
-		} else if (prop_spec) {
-			g_value_init (value, prop_spec->value_type);
-			g_object_get_property (G_OBJECT (setting), prop_spec->name, value);
-
-			/* Don't serialize values with default values */
-			set = !g_param_value_defaults (prop_spec, value);
-
-			/* Convert the property value if necessary */
-			if (set && property->to_dbus) {
-				GValue *dbus_value = g_slice_new0 (GValue);
-
-				g_value_init (dbus_value, property->dbus_type);
-				property->to_dbus (value, dbus_value);
-				destroy_gvalue (value);
-				value = dbus_value;
-			}
-		} else
+		if (property->get_func)
+			dbus_value = property->get_func (setting, connection, property->name);
+		else if (prop_spec)
+			dbus_value = get_property_for_dbus (setting, property, TRUE);
+		else
 			g_assert_not_reached ();
+		if (dbus_value) {
+			/* Allow dbus_value to be either floating or not. */
+			g_variant_take_ref (dbus_value);
 
-		if (set)
-			g_hash_table_insert (hash, g_strdup (property->name), value);
-		else
-			destroy_gvalue (value);
+			g_variant_builder_add (&builder, "{sv}", property->name, dbus_value);
+			g_variant_unref (dbus_value);
+		}
 	}
 
-	return hash;
+	return g_variant_builder_end (&builder);
 }
 
 /**
  * _nm_setting_new_from_dbus:
  * @setting_type: the #NMSetting type which the hash contains properties for
- * @setting_hash: (element-type utf8 GObject.Value): the #GHashTable containing a
- *   string to #GValue mapping of properties that apply to the setting
- * @connection_hash: (element-type utf8 GObject.Value): the #GHashTable containing a
- *   string to #GHashTable mapping of properties for the whole connection
+ * @setting_dict: the #GVariant containing an %NM_VARIANT_TYPE_SETTING dictionary
+ *   mapping property names to values
+ * @connection_dict: the #GVariant containing an %NM_VARIANT_TYPE_CONNECTION
+ *   dictionary mapping setting names to dictionaries.
  * @error: location to store error, or %NULL
  *
  * Creates a new #NMSetting object and populates that object with the properties
- * contained in the hash table, using each hash key as the property to set,
- * and each hash value as the value to set that property to.  Setting properties
- * are strongly typed, thus the GValue type of the hash value must be correct.
- * See the documentation on each #NMSetting object subclass for the correct
- * property names and value types.
+ * contained in @setting_dict, using each key as the property to set, and each
+ * value as the value to set that property to.  Setting properties are strongly
+ * typed, thus the #GVariantType of the dict value must be correct.  See the
+ * documentation on each #NMSetting object subclass for the correct property
+ * names and value types.
  *
  * Returns: a new #NMSetting object populated with the properties from the
  * hash table, or %NULL if @setting_hash could not be deserialized.
  **/
 NMSetting *
 _nm_setting_new_from_dbus (GType setting_type,
-                           GHashTable *setting_hash,
-                           GHashTable *connection_hash,
+                           GVariant *setting_dict,
+                           GVariant *connection_dict,
                            GError **error)
 {
-	NMSetting *setting;
 	NMSettingClass *class;
-	GHashTableIter iter;
+	NMSetting *setting;
+	GVariantIter iter;
 	const char *prop_name;
 	const NMSettingProperty *properties;
 	guint n_properties;
 	guint i;
 
 	g_return_val_if_fail (G_TYPE_IS_INSTANTIATABLE (setting_type), NULL);
-	g_return_val_if_fail (setting_hash != NULL, NULL);
+	g_return_val_if_fail (g_variant_is_of_type (setting_dict, NM_VARIANT_TYPE_SETTING), NULL);
+
+	/* connection_dict is not technically optional, but some tests in test-general
+	 * don't bother with it in cases where they know it's not needed.
+	 */
+	if (connection_dict)
+		g_return_val_if_fail (g_variant_is_of_type (connection_dict, NM_VARIANT_TYPE_CONNECTION), NULL);
 
 	/* g_type_class_ref() ensures the setting class is created if it hasn't
 	 * already been used.
@@ -776,8 +822,8 @@ _nm_setting_new_from_dbus (GType setting_type,
 	class = g_type_class_ref (setting_type);
 
 	/* Check for invalid properties first. */
-	g_hash_table_iter_init (&iter, setting_hash);
-	while (g_hash_table_iter_next (&iter, (gpointer) &prop_name, NULL)) {
+	g_variant_iter_init (&iter, setting_dict);
+	while (g_variant_iter_next (&iter, "{&sv}", &prop_name, NULL)) {
 		if (!nm_setting_class_find_property (class, prop_name)) {
 			/* Oh, we're so nice and only warn, maybe it should be a fatal error? */
 			g_warning ("Ignoring invalid property '%s'", prop_name);
@@ -791,31 +837,30 @@ _nm_setting_new_from_dbus (GType setting_type,
 	properties = nm_setting_class_get_properties (class, &n_properties);
 	for (i = 0; i < n_properties; i++) {
 		const NMSettingProperty *property = &properties[i];
-		GValue *value = g_hash_table_lookup (setting_hash, property->name);
+		GVariant *value = g_variant_lookup_value (setting_dict, property->name, NULL);
 
 		if (value && property->set_func) {
 			property->set_func (setting,
-			                    connection_hash,
+			                    connection_dict,
 			                    property->name,
 			                    value);
 		} else if (!value && property->not_set_func) {
 			property->not_set_func (setting,
-			                        connection_hash,
+			                        connection_dict,
 			                        property->name);
 		} else if (value && property->param_spec) {
+			GValue object_value = { 0, };
+
 			if (!(property->param_spec->flags & G_PARAM_WRITABLE))
 				continue;
 
-			if (property->from_dbus)  {
-				GValue object_value = G_VALUE_INIT;
-
-				g_value_init (&object_value, property->param_spec->value_type);
-				property->from_dbus (value, &object_value);
-				g_object_set_property (G_OBJECT (setting), property->param_spec->name, &object_value);
-				g_value_unset (&object_value);
-			} else
-				g_object_set_property (G_OBJECT (setting), property->param_spec->name, value);
+			g_value_init (&object_value, property->param_spec->value_type);
+			set_property_from_dbus (property, value, &object_value);
+			g_object_set_property (G_OBJECT (setting), property->param_spec->name, &object_value);
 		}
+
+		if (value)
+			g_variant_unref (value);
 	}
 
 	g_type_class_unref (class);
@@ -945,8 +990,7 @@ compare_property (NMSetting *setting,
                   NMSettingCompareFlags flags)
 {
 	const NMSettingProperty *property;
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
+	GVariant *value1, *value2;
 	int cmp;
 
 	/* Handle compare flags */
@@ -976,29 +1020,13 @@ compare_property (NMSetting *setting,
 	property = nm_setting_class_find_property (NM_SETTING_GET_CLASS (setting), prop_spec->name);
 	g_return_val_if_fail (property != NULL, FALSE);
 
-	g_value_init (&value1, prop_spec->value_type);
-	g_object_get_property (G_OBJECT (setting), prop_spec->name, &value1);
-
-	g_value_init (&value2, prop_spec->value_type);
-	g_object_get_property (G_OBJECT (other), prop_spec->name, &value2);
-
-	if (property->to_dbus) {
-		GValue dbus_value1 = G_VALUE_INIT, dbus_value2 = G_VALUE_INIT;
-
-		g_value_init (&dbus_value1, property->dbus_type);
-		property->to_dbus (&value1, &dbus_value1);
-		g_value_init (&dbus_value2, property->dbus_type);
-		property->to_dbus (&value2, &dbus_value2);
-
-		cmp = nm_property_compare (&dbus_value1, &dbus_value2);
+	value1 = get_property_for_dbus (setting, property, FALSE);
+	value2 = get_property_for_dbus (other, property, FALSE);
 
-		g_value_unset (&dbus_value1);
-		g_value_unset (&dbus_value2);
-	} else
-		cmp = nm_property_compare (&value1, &value2);
+	cmp = nm_property_compare (value1, value2);
 
-	g_value_unset (&value1);
-	g_value_unset (&value2);
+	g_variant_unref (value1);
+	g_variant_unref (value2);
 
 	return cmp == 0;
 }
@@ -1389,10 +1417,11 @@ nm_setting_need_secrets (NMSetting *setting)
 }
 
 static int
-update_one_secret (NMSetting *setting, const char *key, GValue *value, GError **error)
+update_one_secret (NMSetting *setting, const char *key, GVariant *value, GError **error)
 {
 	const NMSettingProperty *property;
 	GParamSpec *prop_spec;
+	GValue prop_value = { 0, };
 
 	property = nm_setting_class_find_property (NM_SETTING_GET_CLASS (setting), key);
 	if (!property) {
@@ -1408,65 +1437,65 @@ update_one_secret (NMSetting *setting, const char *key, GValue *value, GError **
 	if (!prop_spec || !(prop_spec->flags & NM_SETTING_PARAM_SECRET))
 		return NM_SETTING_UPDATE_SECRET_SUCCESS_UNCHANGED;
 
-	if (g_value_type_compatible (G_VALUE_TYPE (value), G_PARAM_SPEC_VALUE_TYPE (prop_spec))) {
-		if (G_VALUE_HOLDS_STRING (value) && G_IS_PARAM_SPEC_STRING (prop_spec)) {
-			/* String is expected to be a common case. Handle it specially and check whether
-			 * the value is already set. Otherwise, we just reset the property and
-			 * assume the value got modified. */
-			char *v;
-
-			g_object_get (G_OBJECT (setting), prop_spec->name, &v, NULL);
-			if (g_strcmp0 (v, g_value_get_string (value)) == 0) {
-				g_free (v);
-				return NM_SETTING_UPDATE_SECRET_SUCCESS_UNCHANGED;
-			}
+	if (   g_variant_is_of_type (value, G_VARIANT_TYPE_STRING)
+	    && G_IS_PARAM_SPEC_STRING (prop_spec)) {
+		/* String is expected to be a common case. Handle it specially and check
+		 * whether the value is already set. Otherwise, we just reset the
+		 * property and assume the value got modified.
+		 */
+		char *v;
+
+		g_object_get (G_OBJECT (setting), prop_spec->name, &v, NULL);
+		if (g_strcmp0 (v, g_variant_get_string (value, NULL)) == 0) {
 			g_free (v);
+			return NM_SETTING_UPDATE_SECRET_SUCCESS_UNCHANGED;
 		}
-		g_object_set_property (G_OBJECT (setting), prop_spec->name, value);
-		return NM_SETTING_UPDATE_SECRET_SUCCESS_MODIFIED;
+		g_free (v);
 	}
-	g_set_error (error,
-	             NM_SETTING_ERROR,
-	             NM_SETTING_ERROR_PROPERTY_TYPE_MISMATCH,
-	             "%s", key);
-	return NM_SETTING_UPDATE_SECRET_ERROR;
+
+	g_value_init (&prop_value, prop_spec->value_type);
+	set_property_from_dbus (property, value, &prop_value);
+	g_object_set_property (G_OBJECT (setting), prop_spec->name, &prop_value);
+	g_value_unset (&prop_value);
+
+	return NM_SETTING_UPDATE_SECRET_SUCCESS_MODIFIED;
 }
 
 /**
  * _nm_setting_update_secrets:
  * @setting: the #NMSetting
- * @secrets: (element-type utf8 GObject.Value): a #GHashTable mapping
- * string to #GValue of setting property names and secrets
+ * @secrets: a #GVariant of type #NM_VARIANT_TYPE_SETTING, mapping property
+ *   names to secrets.
  * @error: location to store error, or %NULL
  *
- * Update the setting's secrets, given a hash table of secrets intended for that
+ * Update the setting's secrets, given a dictionary of secrets intended for that
  * setting (deserialized from D-Bus for example).
  *
  * Returns: an #NMSettingUpdateSecretResult
- * update one or more of the secrets.
  **/
 NMSettingUpdateSecretResult
-_nm_setting_update_secrets (NMSetting *setting, GHashTable *secrets, GError **error)
+_nm_setting_update_secrets (NMSetting *setting, GVariant *secrets, GError **error)
 {
-	GHashTableIter iter;
-	gpointer key, data;
+	GVariantIter iter;
+	const char *secret_key;
+	GVariant *secret_value;
 	GError *tmp_error = NULL;
 	NMSettingUpdateSecretResult result = NM_SETTING_UPDATE_SECRET_SUCCESS_UNCHANGED;
 
 	g_return_val_if_fail (NM_IS_SETTING (setting), NM_SETTING_UPDATE_SECRET_ERROR);
-	g_return_val_if_fail (secrets != NULL, NM_SETTING_UPDATE_SECRET_ERROR);
+	g_return_val_if_fail (g_variant_is_of_type (secrets, NM_VARIANT_TYPE_SETTING), NM_SETTING_UPDATE_SECRET_ERROR);
 	if (error)
 		g_return_val_if_fail (*error == NULL, NM_SETTING_UPDATE_SECRET_ERROR);
 
-	g_hash_table_iter_init (&iter, secrets);
-	while (g_hash_table_iter_next (&iter, &key, &data)) {
+	g_variant_iter_init (&iter, secrets);
+	while (g_variant_iter_next (&iter, "{&sv}", &secret_key, &secret_value)) {
 		int success;
-		const char *secret_key = (const char *) key;
-		GValue *secret_value = (GValue *) data;
 
 		success = NM_SETTING_GET_CLASS (setting)->update_one_secret (setting, secret_key, secret_value, &tmp_error);
 		g_assert (!((success == NM_SETTING_UPDATE_SECRET_ERROR) ^ (!!tmp_error)));
 
+		g_variant_unref (secret_value);
+
 		if (success == NM_SETTING_UPDATE_SECRET_ERROR) {
 			g_propagate_error (error, tmp_error);
 			return NM_SETTING_UPDATE_SECRET_ERROR;
@@ -1707,22 +1736,20 @@ _nm_setting_verify_required_virtual_interface_name (GSList *all_settings,
 	return NM_SETTING_VERIFY_SUCCESS;
 }
 
-gboolean
+GVariant *
 _nm_setting_get_deprecated_virtual_interface_name (NMSetting *setting,
                                                    NMConnection *connection,
-                                                   const char *property,
-                                                   GValue *value)
+                                                   const char *property)
 {
 	NMSettingConnection *s_con;
 
 	s_con = nm_connection_get_setting_connection (connection);
-	g_return_val_if_fail (s_con != NULL, FALSE);
+	g_return_val_if_fail (s_con != NULL, NULL);
 
-	if (nm_setting_connection_get_interface_name (s_con)) {
-		g_value_set_string (value, nm_setting_connection_get_interface_name (s_con));
-		return TRUE;
-	} else
-		return FALSE;
+	if (nm_setting_connection_get_interface_name (s_con))
+		return g_variant_new_string (nm_setting_connection_get_interface_name (s_con));
+	else
+		return NULL;
 }
 
 /*****************************************************************************/
diff --git a/libnm-core/nm-setting.h b/libnm-core/nm-setting.h
index c2fef09f1b..80fc7bb6a6 100644
--- a/libnm-core/nm-setting.h
+++ b/libnm-core/nm-setting.h
@@ -179,7 +179,7 @@ typedef struct {
 
 	int         (*update_one_secret) (NMSetting  *setting,
 	                                  const char *key,
-	                                  GValue     *value,
+	                                  GVariant   *value,
 	                                  GError    **error);
 
 	gboolean    (*get_secret_flags)  (NMSetting  *setting,
diff --git a/libnm-core/nm-simple-connection.c b/libnm-core/nm-simple-connection.c
index 3c05cccf46..03e5a92d81 100644
--- a/libnm-core/nm-simple-connection.c
+++ b/libnm-core/nm-simple-connection.c
@@ -50,8 +50,7 @@ nm_simple_connection_new (void)
 
 /**
  * nm_simple_connection_new_from_dbus:
- * @hash: (element-type utf8 GLib.HashTable): the #GHashTable describing
- * the connection
+ * @dict: a #GVariant of type %NM_VARIANT_TYPE_CONNECTION describing the connection
  * @error: on unsuccessful return, an error
  *
  * Creates a new #NMSimpleConnection from a hash table describing the
@@ -63,14 +62,15 @@ nm_simple_connection_new (void)
  * connection failed to validate
  **/
 NMConnection *
-nm_simple_connection_new_from_dbus (GHashTable *hash, GError **error)
+nm_simple_connection_new_from_dbus (GVariant *dict, GError **error)
 {
 	NMConnection *connection;
 
-	g_return_val_if_fail (hash != NULL, NULL);
+	g_return_val_if_fail (dict != NULL, NULL);
+	g_return_val_if_fail (g_variant_is_of_type (dict, NM_VARIANT_TYPE_CONNECTION), NULL);
 
 	connection = nm_simple_connection_new ();
-	if (   !nm_connection_replace_settings (connection, hash, error)
+	if (   !nm_connection_replace_settings (connection, dict, error)
 	    || !nm_connection_verify (connection, error))
 		g_clear_object (&connection);
 	return connection;
diff --git a/libnm-core/nm-simple-connection.h b/libnm-core/nm-simple-connection.h
index b535ed9db9..aea04e3a67 100644
--- a/libnm-core/nm-simple-connection.h
+++ b/libnm-core/nm-simple-connection.h
@@ -51,7 +51,7 @@ GType nm_simple_connection_get_type (void);
 
 NMConnection *nm_simple_connection_new           (void);
 
-NMConnection *nm_simple_connection_new_from_dbus (GHashTable    *hash,
+NMConnection *nm_simple_connection_new_from_dbus (GVariant      *dict,
                                                   GError       **error);
 
 NMConnection *nm_simple_connection_new_clone     (NMConnection  *connection);
diff --git a/libnm-core/nm-utils-private.h b/libnm-core/nm-utils-private.h
index be9619dbf6..978454772f 100644
--- a/libnm-core/nm-utils-private.h
+++ b/libnm-core/nm-utils-private.h
@@ -32,47 +32,38 @@ gboolean    _nm_utils_string_slist_validate (GSList *list,
 gboolean    _nm_utils_gvalue_array_validate (GValueArray *elements,
                                              guint n_expected, ...);
 
-void        _nm_value_transforms_register (void);
+/* D-Bus transform funcs */
 
-void        _nm_utils_hwaddr_to_dbus   (const GValue *prop_value,
-                                        GValue *dbus_value);
-void        _nm_utils_hwaddr_from_dbus (const GValue *dbus_value,
+GVariant *  _nm_utils_hwaddr_to_dbus   (const GValue *prop_value);
+void        _nm_utils_hwaddr_from_dbus (GVariant *dbus_value,
                                         GValue *prop_value);
 
-void        _nm_utils_strdict_to_dbus   (const GValue *prop_value,
-                                         GValue *dbus_value);
-void        _nm_utils_strdict_from_dbus (const GValue *dbus_value,
+GVariant *  _nm_utils_strdict_to_dbus   (const GValue *prop_value);
+void        _nm_utils_strdict_from_dbus (GVariant *dbus_value,
                                          GValue *prop_value);
 
-void        _nm_utils_bytes_to_dbus     (const GValue *prop_value,
-                                         GValue *dbus_value);
-void        _nm_utils_bytes_from_dbus   (const GValue *dbus_value,
+GVariant *  _nm_utils_bytes_to_dbus     (const GValue *prop_value);
+void        _nm_utils_bytes_from_dbus   (GVariant *dbus_value,
                                          GValue *prop_value);
 
-void        _nm_utils_ip4_dns_to_dbus         (const GValue *prop_value,
-                                               GValue *dbus_value);
-void        _nm_utils_ip4_dns_from_dbus       (const GValue *dbus_value,
+GVariant *  _nm_utils_ip4_dns_to_dbus         (const GValue *prop_value);
+void        _nm_utils_ip4_dns_from_dbus       (GVariant *dbus_value,
                                                GValue *prop_value);
-void        _nm_utils_ip4_addresses_to_dbus   (const GValue *prop_value,
-                                               GValue *dbus_value);
-void        _nm_utils_ip4_addresses_from_dbus (const GValue *dbus_value,
+GVariant *  _nm_utils_ip4_addresses_to_dbus   (const GValue *prop_value);
+void        _nm_utils_ip4_addresses_from_dbus (GVariant *dbus_value,
                                                GValue *prop_value);
-void        _nm_utils_ip4_routes_to_dbus      (const GValue *prop_value,
-                                               GValue *dbus_value);
-void        _nm_utils_ip4_routes_from_dbus    (const GValue *dbus_value,
+GVariant *  _nm_utils_ip4_routes_to_dbus      (const GValue *prop_value);
+void        _nm_utils_ip4_routes_from_dbus    (GVariant *dbus_value,
                                                GValue *prop_value);
 
-void        _nm_utils_ip6_dns_to_dbus         (const GValue *prop_value,
-                                               GValue *dbus_value);
-void        _nm_utils_ip6_dns_from_dbus       (const GValue *dbus_value,
+GVariant *  _nm_utils_ip6_dns_to_dbus         (const GValue *prop_value);
+void        _nm_utils_ip6_dns_from_dbus       (GVariant *dbus_value,
                                                GValue *prop_value);
-void        _nm_utils_ip6_addresses_to_dbus   (const GValue *prop_value,
-                                               GValue *dbus_value);
-void        _nm_utils_ip6_addresses_from_dbus (const GValue *dbus_value,
+GVariant *  _nm_utils_ip6_addresses_to_dbus   (const GValue *prop_value);
+void        _nm_utils_ip6_addresses_from_dbus (GVariant *dbus_value,
                                                GValue *prop_value);
-void        _nm_utils_ip6_routes_to_dbus      (const GValue *prop_value,
-                                               GValue *dbus_value);
-void        _nm_utils_ip6_routes_from_dbus    (const GValue *dbus_value,
+GVariant *  _nm_utils_ip6_routes_to_dbus      (const GValue *prop_value);
+void        _nm_utils_ip6_routes_from_dbus    (GVariant *dbus_value,
                                                GValue *prop_value);
 
 GSList *    _nm_utils_strv_to_slist (char **strv);
diff --git a/libnm-core/nm-utils.c b/libnm-core/nm-utils.c
index 2a0497c342..3054b3722f 100644
--- a/libnm-core/nm-utils.c
+++ b/libnm-core/nm-utils.c
@@ -234,8 +234,6 @@ nm_utils_init (GError **error)
 
 		if (!crypto_init (error))
 			return FALSE;
-
-		_nm_value_transforms_register ();
 	}
 	return TRUE;
 }
@@ -566,18 +564,80 @@ _nm_utils_hash_values_to_slist (GHashTable *hash)
 	return list;
 }
 
-void
-_nm_utils_strdict_to_dbus (const GValue *prop_value,
-                           GValue *dbus_value)
+/**
+ * _nm_utils_connection_hash_to_dict:
+ * @hash: a hashed #NMConnection
+ *
+ * Returns: a (floating) #GVariant equivalent to @hash.
+ */
+GVariant *
+_nm_utils_connection_hash_to_dict (GHashTable *hash)
+{
+	GValue val = { 0, };
+	GVariant *variant;
+
+	if (!hash)
+		return NULL;
+
+	g_value_init (&val, DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT);
+	g_value_set_boxed (&val, hash);
+	variant = dbus_g_value_build_g_variant (&val);
+	g_value_unset (&val);
+
+	return variant;
+}
+
+/**
+ * _nm_utils_connection_dict_to_hash:
+ * @dict: a #GVariant-serialized #NMConnection
+ *
+ * Returns: a #GHashTable equivalent to @dict.
+ */
+GHashTable *
+_nm_utils_connection_dict_to_hash (GVariant *dict)
+{
+	GValue val = { 0, };
+
+	if (!dict)
+		return NULL;
+
+	dbus_g_value_parse_g_variant (dict, &val);
+	return g_value_get_boxed (&val);
+}
+
+GVariant *
+_nm_utils_strdict_to_dbus (const GValue *prop_value)
 {
-	g_value_set_boxed (dbus_value, g_value_get_boxed (prop_value));
+	GHashTable *hash;
+	GHashTableIter iter;
+	gpointer key, value;
+	GVariantBuilder builder;
+
+	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{ss}"));
+	hash = g_value_get_boxed (prop_value);
+	if (hash) {
+		g_hash_table_iter_init (&iter, hash);
+		while (g_hash_table_iter_next (&iter, &key, &value))
+			g_variant_builder_add (&builder, "{ss}", key, value);
+	}
+
+	return g_variant_builder_end (&builder);
 }
 
 void
-_nm_utils_strdict_from_dbus (const GValue *dbus_value,
+_nm_utils_strdict_from_dbus (GVariant *dbus_value,
                              GValue *prop_value)
 {
-	g_value_set_boxed (prop_value, g_value_get_boxed (dbus_value));
+	GVariantIter iter;
+	const char *key, *value;
+	GHashTable *hash;
+
+	hash = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_free);
+	g_variant_iter_init (&iter, dbus_value);
+	while (g_variant_iter_next (&iter, "{&s&s}", &key, &value))
+		g_hash_table_insert (hash, g_strdup (key), g_strdup (value));
+
+	g_value_take_boxed (prop_value, hash);
 }
 
 GHashTable *
@@ -652,32 +712,37 @@ _nm_utils_copy_object_array (const GPtrArray *array)
 	return _nm_utils_copy_array (array, g_object_ref, g_object_unref);
 }
 
-void
-_nm_utils_bytes_to_dbus (const GValue *prop_value,
-                         GValue *dbus_value)
+GVariant *
+_nm_utils_bytes_to_dbus (const GValue *prop_value)
 {
 	GBytes *bytes = g_value_get_boxed (prop_value);
-	GByteArray *ba = NULL;
 
 	if (bytes) {
-		ba = g_byte_array_new ();
-		g_byte_array_append (ba,
-		                     g_bytes_get_data (bytes, NULL),
-		                     g_bytes_get_size (bytes));
+		return g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+		                                  g_bytes_get_data (bytes, NULL),
+		                                  g_bytes_get_size (bytes),
+		                                  1);
+	} else {
+		return g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+		                                  NULL, 0,
+		                                  1);
 	}
-
-	g_value_take_boxed (dbus_value, ba);
 }
 
 void
-_nm_utils_bytes_from_dbus (const GValue *dbus_value,
+_nm_utils_bytes_from_dbus (GVariant *dbus_value,
                            GValue *prop_value)
 {
-	GByteArray *ba = g_value_dup_boxed (dbus_value);
-	GBytes *bytes = NULL;
+	GBytes *bytes;
 
-	if (ba)
-		bytes = g_byte_array_free_to_bytes (ba);
+	if (g_variant_n_children (dbus_value)) {
+		gconstpointer data;
+		gsize length;
+
+		data = g_variant_get_fixed_array (dbus_value, &length, 1);
+		bytes = g_bytes_new (data, length);
+	} else
+		bytes = NULL;
 	g_value_take_boxed (prop_value, bytes);
 }
 
@@ -1078,191 +1143,6 @@ nm_utils_wpa_psk_valid (const char *psk)
 	return TRUE;
 }
 
-void
-_nm_utils_ip4_dns_to_dbus (const GValue *prop_value,
-                           GValue *dbus_value)
-{
-	char **dns;
-	int i;
-	GArray *array;
-
-	dns = g_value_get_boxed (prop_value);
-	array = g_array_new (FALSE, FALSE, sizeof (guint32));
-
-	if (dns) {
-		for (i = 0; dns[i]; i++) {
-			guint32 ip = 0;
-
-			inet_pton (AF_INET, dns[i], &ip);
-			g_array_append_val (array, ip);
-		}
-	}
-
-	g_value_take_boxed (dbus_value, array);
-}
-
-void
-_nm_utils_ip4_dns_from_dbus (const GValue *dbus_value,
-                             GValue *prop_value)
-{
-	GArray *array;
-	GPtrArray *dns;
-	int i;
-
-	array = g_value_get_boxed (dbus_value);
-	dns = g_ptr_array_new ();
-
-	if (array) {
-		for (i = 0; i < array->len; i++) {
-			guint32 ip = g_array_index (array, guint32, i);
-			const char *str;
-
-			str = nm_utils_inet4_ntop (ip, NULL);
-			g_ptr_array_add (dns, g_strdup (str));
-		}
-	}
-
-	g_ptr_array_add (dns, NULL);
-	g_value_take_boxed (prop_value, g_ptr_array_free (dns, FALSE));
-}
-
-void
-_nm_utils_ip4_addresses_to_dbus (const GValue *prop_value,
-                                 GValue *dbus_value)
-{
-	GPtrArray *addresses, *dbus_addresses;
-	int i;
-
-	addresses = g_value_get_boxed (prop_value);
-	dbus_addresses = g_ptr_array_new ();
-
-	if (addresses) {
-		for (i = 0; i < addresses->len; i++) {
-			NMIP4Address *addr = addresses->pdata[i];
-			GArray *array;
-			guint32 tmp;
-
-			array = g_array_sized_new (FALSE, TRUE, sizeof (guint32), 3);
-
-			tmp = nm_ip4_address_get_address (addr);
-			g_array_append_val (array, tmp);
-
-			tmp = nm_ip4_address_get_prefix (addr);
-			g_array_append_val (array, tmp);
-
-			tmp = nm_ip4_address_get_gateway (addr);
-			g_array_append_val (array, tmp);
-
-			g_ptr_array_add (dbus_addresses, array);
-		}
-	}
-
-	g_value_take_boxed (dbus_value, dbus_addresses);
-}
-
-void
-_nm_utils_ip4_addresses_from_dbus (const GValue *dbus_value,
-                                   GValue *prop_value)
-{
-	GPtrArray *dbus_addresses;
-	GPtrArray *addresses;
-	int i;
-
-	dbus_addresses = g_value_get_boxed (dbus_value);
-	addresses = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_ip4_address_unref);
-
-	if (dbus_addresses) {
-		for (i = 0; i < dbus_addresses->len; i++) {
-			GArray *array = dbus_addresses->pdata[i];
-			NMIP4Address *addr;
-
-			if (array->len < 3) {
-				g_warning ("Ignoring invalid IP4 address");
-				continue;
-			}
-
-			addr = nm_ip4_address_new ();
-			nm_ip4_address_set_address (addr, g_array_index (array, guint32, 0));
-			nm_ip4_address_set_prefix (addr, g_array_index (array, guint32, 1));
-			nm_ip4_address_set_gateway (addr, g_array_index (array, guint32, 2));
-
-			g_ptr_array_add (addresses, addr);
-		}
-	}
-
-	g_value_take_boxed (prop_value, addresses);
-}
-
-void
-_nm_utils_ip4_routes_to_dbus (const GValue *prop_value,
-                              GValue *dbus_value)
-{
-	GPtrArray *routes, *dbus_routes;
-	int i;
-
-	routes = g_value_get_boxed (prop_value);
-	dbus_routes = g_ptr_array_new ();
-
-	if (routes) {
-		for (i = 0; i < routes->len; i++) {
-			NMIP4Route *route = routes->pdata[i];
-			GArray *array;
-			guint32 tmp;
-
-			array = g_array_sized_new (FALSE, TRUE, sizeof (guint32), 4);
-
-			tmp = nm_ip4_route_get_dest (route);
-			g_array_append_val (array, tmp);
-
-			tmp = nm_ip4_route_get_prefix (route);
-			g_array_append_val (array, tmp);
-
-			tmp = nm_ip4_route_get_next_hop (route);
-			g_array_append_val (array, tmp);
-
-			tmp = nm_ip4_route_get_metric (route);
-			g_array_append_val (array, tmp);
-
-			g_ptr_array_add (dbus_routes, array);
-		}
-	}
-
-	g_value_take_boxed (dbus_value, dbus_routes);
-}
-
-void
-_nm_utils_ip4_routes_from_dbus (const GValue *dbus_value,
-                                GValue *prop_value)
-{
-	GPtrArray *dbus_routes, *routes;
-	int i;
-
-	dbus_routes = g_value_get_boxed (dbus_value);
-	routes = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_ip4_route_unref);
-
-	if (dbus_routes) {
-		for (i = 0; i < dbus_routes->len; i++) {
-			GArray *array = dbus_routes->pdata[i];
-			NMIP4Route *route;
-
-			if (array->len < 4) {
-				g_warning ("Ignoring invalid IP4 route");
-				continue;
-			}
-
-			route = nm_ip4_route_new ();
-			nm_ip4_route_set_dest (route, g_array_index (array, guint32, 0));
-			nm_ip4_route_set_prefix (route, g_array_index (array, guint32, 1));
-			nm_ip4_route_set_next_hop (route, g_array_index (array, guint32, 2));
-			nm_ip4_route_set_metric (route, g_array_index (array, guint32, 3));
-
-			g_ptr_array_add (routes, route);
-		}
-	}
-
-	g_value_take_boxed (prop_value, routes);
-}
-
 /**
  * nm_utils_ip4_addresses_from_gvalue:
  * @value: #GValue containing a #GPtrArray of #GArrays of #guint32s
@@ -1728,289 +1608,6 @@ nm_utils_ip4_get_default_prefix (guint32 ip)
 	return 24;  /* Class C - 255.255.255.0 */
 }
 
-void
-_nm_utils_ip6_dns_to_dbus (const GValue *prop_value,
-                           GValue *dbus_value)
-{
-	char **dns;
-	GPtrArray *dbus_dns;
-	int i;
-
-	dns = g_value_get_boxed (prop_value);
-	dbus_dns = g_ptr_array_new ();
-
-	if (dns) {
-		for (i = 0; dns[i]; i++) {
-			GByteArray *bytearray;
-
-			bytearray = g_byte_array_new ();
-			g_byte_array_set_size (bytearray, 16);
-			inet_pton (AF_INET6, dns[i], bytearray->data);
-			g_ptr_array_add (dbus_dns, bytearray);
-		}
-	}
-
-	g_value_take_boxed (dbus_value, dbus_dns);
-}
-
-void
-_nm_utils_ip6_dns_from_dbus (const GValue *dbus_value,
-                             GValue *prop_value)
-{
-	GPtrArray *dbus_dns, *dns;
-	int i;
-
-	dbus_dns = g_value_get_boxed (dbus_value);
-	dns = g_ptr_array_new ();
-
-	if (dbus_dns) {
-		for (i = 0; i < dbus_dns->len; i++) {
-			GByteArray *bytearray = dbus_dns->pdata[i];
-			const char *str;
-
-			if (bytearray->len != 16) {
-				g_warning ("%s: ignoring invalid IP6 address of length %d",
-				           __func__, bytearray->len);
-				continue;
-			}
-
-			str = nm_utils_inet6_ntop ((struct in6_addr *) bytearray->data, NULL);
-			g_ptr_array_add (dns, g_strdup (str));
-		}
-	}
-
-	g_ptr_array_add (dns, NULL);
-	g_value_take_boxed (prop_value, g_ptr_array_free (dns, FALSE));
-}
-
-void
-_nm_utils_ip6_addresses_to_dbus (const GValue *prop_value,
-                                 GValue *dbus_value)
-{
-	GPtrArray *addresses, *dbus_addresses;
-	int i;
-
-	addresses = g_value_get_boxed (prop_value);
-	dbus_addresses = g_ptr_array_new ();
-
-	if (addresses) {
-		for (i = 0; i < addresses->len; i++) {
-			NMIP6Address *addr = addresses->pdata[i];
-			GValueArray *array;
-			GValue element = G_VALUE_INIT;
-			GByteArray *ba;
-
-			array = g_value_array_new (3);
-
-			/* IP address */
-			g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-			ba = g_byte_array_new ();
-			g_byte_array_append (ba, (guint8 *) nm_ip6_address_get_address (addr), 16);
-			g_value_take_boxed (&element, ba);
-			g_value_array_append (array, &element);
-			g_value_unset (&element);
-
-			/* Prefix */
-			g_value_init (&element, G_TYPE_UINT);
-			g_value_set_uint (&element, nm_ip6_address_get_prefix (addr));
-			g_value_array_append (array, &element);
-			g_value_unset (&element);
-
-			/* Gateway */
-			g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-			ba = g_byte_array_new ();
-			g_byte_array_append (ba, (guint8 *) nm_ip6_address_get_gateway (addr), 16);
-			g_value_take_boxed (&element, ba);
-			g_value_array_append (array, &element);
-			g_value_unset (&element);
-
-			g_ptr_array_add (dbus_addresses, array);
-		}
-	}
-
-	g_value_take_boxed (dbus_value, dbus_addresses);
-}
-
-void
-_nm_utils_ip6_addresses_from_dbus (const GValue *dbus_value,
-                                   GValue *prop_value)
-{
-	GPtrArray *addresses, *dbus_addresses;
-	int i;
-
-	dbus_addresses = g_value_get_boxed (dbus_value);
-	addresses = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_ip6_address_unref);
-
-	if (dbus_addresses) {
-		for (i = 0; i < dbus_addresses->len; i++) {
-			GValueArray *elements = dbus_addresses->pdata[i];
-			GValue *tmp;
-			GByteArray *ba_addr;
-			GByteArray *ba_gw = NULL;
-			NMIP6Address *addr;
-			guint32 prefix;
-
-			if (elements->n_values < 2 || elements->n_values > 3) {
-				g_warning ("%s: ignoring invalid IP6 address structure", __func__);
-				continue;
-			}
-
-			/* Third element (gateway) is optional */
-			if (   !_nm_utils_gvalue_array_validate (elements, 2, DBUS_TYPE_G_UCHAR_ARRAY, G_TYPE_UINT)
-			    && !_nm_utils_gvalue_array_validate (elements, 3, DBUS_TYPE_G_UCHAR_ARRAY, G_TYPE_UINT, DBUS_TYPE_G_UCHAR_ARRAY)) {
-				g_warning ("%s: ignoring invalid IP6 address structure", __func__);
-				continue;
-			}
-
-			tmp = g_value_array_get_nth (elements, 0);
-			ba_addr = g_value_get_boxed (tmp);
-			if (ba_addr->len != 16) {
-				g_warning ("%s: ignoring invalid IP6 address of length %d",
-				           __func__, ba_addr->len);
-				continue;
-			}
-
-			tmp = g_value_array_get_nth (elements, 1);
-			prefix = g_value_get_uint (tmp);
-			if (prefix > 128) {
-				g_warning ("%s: ignoring invalid IP6 prefix %d",
-				           __func__, prefix);
-				continue;
-			}
-
-			if (elements->n_values == 3) {
-				tmp = g_value_array_get_nth (elements, 2);
-				ba_gw = g_value_get_boxed (tmp);
-				if (ba_gw->len != 16) {
-					g_warning ("%s: ignoring invalid IP6 gateway address of length %d",
-					           __func__, ba_gw->len);
-					continue;
-				}
-			}
-
-			addr = nm_ip6_address_new ();
-			nm_ip6_address_set_prefix (addr, prefix);
-			nm_ip6_address_set_address (addr, (const struct in6_addr *) ba_addr->data);
-			if (ba_gw)
-				nm_ip6_address_set_gateway (addr, (const struct in6_addr *) ba_gw->data);
-
-			g_ptr_array_add (addresses, addr);
-		}
-	}
-
-	g_value_take_boxed (prop_value, addresses);
-}
-
-void
-_nm_utils_ip6_routes_to_dbus (const GValue *prop_value,
-                              GValue *dbus_value)
-{
-	GPtrArray *routes, *dbus_routes;
-	int i;
-
-	routes = g_value_get_boxed (prop_value);
-	dbus_routes = g_ptr_array_new ();
-
-	if (routes) {
-		for (i = 0; i < routes->len; i++) {
-			NMIP6Route *route = routes->pdata[i];
-			GValueArray *array;
-			const struct in6_addr *addr;
-			GByteArray *ba;
-			GValue element = G_VALUE_INIT;
-
-			array = g_value_array_new (4);
-
-			g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-			addr = nm_ip6_route_get_dest (route);
-			ba = g_byte_array_new ();
-			g_byte_array_append (ba, (guchar *)addr, sizeof (*addr));
-			g_value_take_boxed (&element, ba);
-			g_value_array_append (array, &element);
-			g_value_unset (&element);
-
-			g_value_init (&element, G_TYPE_UINT);
-			g_value_set_uint (&element, nm_ip6_route_get_prefix (route));
-			g_value_array_append (array, &element);
-			g_value_unset (&element);
-
-			g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-			addr = nm_ip6_route_get_next_hop (route);
-			ba = g_byte_array_new ();
-			g_byte_array_append (ba, (guchar *)addr, sizeof (*addr));
-			g_value_take_boxed (&element, ba);
-			g_value_array_append (array, &element);
-			g_value_unset (&element);
-
-			g_value_init (&element, G_TYPE_UINT);
-			g_value_set_uint (&element, nm_ip6_route_get_metric (route));
-			g_value_array_append (array, &element);
-			g_value_unset (&element);
-
-			g_ptr_array_add (dbus_routes, array);
-		}
-	}
-
-	g_value_take_boxed (dbus_value, dbus_routes);
-}
-
-void
-_nm_utils_ip6_routes_from_dbus (const GValue *dbus_value,
-                                GValue *prop_value)
-{
-	GPtrArray *routes, *dbus_routes;
-	int i;
-
-	dbus_routes = g_value_get_boxed (dbus_value);
-	routes = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_ip6_route_unref);
-
-	if (dbus_routes) {
-		for (i = 0; i < dbus_routes->len; i++) {
-			GValueArray *route_values = dbus_routes->pdata[i];
-			GByteArray *dest, *next_hop;
-			guint prefix, metric;
-			NMIP6Route *route;
-
-			if (!_nm_utils_gvalue_array_validate (route_values, 4,
-			                                      DBUS_TYPE_G_UCHAR_ARRAY,
-			                                      G_TYPE_UINT,
-			                                      DBUS_TYPE_G_UCHAR_ARRAY,
-			                                      G_TYPE_UINT)) {
-				g_warning ("Ignoring invalid IP6 route");
-				continue;
-			}
-
-			dest = g_value_get_boxed (g_value_array_get_nth (route_values, 0));
-			if (dest->len != 16) {
-				g_warning ("%s: ignoring invalid IP6 dest address of length %d",
-				           __func__, dest->len);
-				continue;
-			}
-
-			prefix = g_value_get_uint (g_value_array_get_nth (route_values, 1));
-
-			next_hop = g_value_get_boxed (g_value_array_get_nth (route_values, 2));
-			if (next_hop->len != 16) {
-				g_warning ("%s: ignoring invalid IP6 next_hop address of length %d",
-				           __func__, next_hop->len);
-				continue;
-			}
-
-			metric = g_value_get_uint (g_value_array_get_nth (route_values, 3));
-
-			route = nm_ip6_route_new ();
-			nm_ip6_route_set_dest (route, (struct in6_addr *)dest->data);
-			nm_ip6_route_set_prefix (route, prefix);
-			nm_ip6_route_set_next_hop (route, (struct in6_addr *)next_hop->data);
-			nm_ip6_route_set_metric (route, metric);
-
-			g_ptr_array_add (routes, route);
-		}
-	}
-
-	g_value_take_boxed (prop_value, routes);
-}
-
 /**
  * nm_utils_ip6_addresses_from_gvalue:
  * @value: gvalue containing a GPtrArray of GValueArrays of (GArray of guchars) and #guint32
@@ -3395,25 +2992,33 @@ nm_utils_hwaddr_matches (gconstpointer hwaddr1,
 	return !memcmp (hwaddr1, hwaddr2, hwaddr1_len);
 }
 
-void
-_nm_utils_hwaddr_to_dbus (const GValue *prop_value,
-                          GValue *dbus_value)
+GVariant *
+_nm_utils_hwaddr_to_dbus (const GValue *prop_value)
 {
 	const char *str = g_value_get_string (prop_value);
-	GByteArray *array;
+	guint8 buf[NM_UTILS_HWADDR_LEN_MAX];
+	int len;
+
+	if (str) {
+		len = hwaddr_binary_len (str);
+		g_return_val_if_fail (len <= NM_UTILS_HWADDR_LEN_MAX, NULL);
+		if (!nm_utils_hwaddr_aton (str, buf, len))
+			len = 0;
+	} else
+		len = 0;
 
-	array = str ? nm_utils_hwaddr_atoba (str, hwaddr_binary_len (str)) : NULL;
-	g_value_take_boxed (dbus_value, array);
+	return g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE, buf, len, 1);
 }
 
 void
-_nm_utils_hwaddr_from_dbus (const GValue *dbus_value,
+_nm_utils_hwaddr_from_dbus (GVariant *dbus_value,
                             GValue *prop_value)
 {
-	GByteArray *array = g_value_get_boxed (dbus_value);
+	gsize length = 0;
+	const guint8 *array = g_variant_get_fixed_array (dbus_value, &length, 1);
 	char *str;
 
-	str = array ? nm_utils_hwaddr_ntoa (array->data, array->len) : NULL;
+	str = length ? nm_utils_hwaddr_ntoa (array, length) : NULL;
 	g_value_take_string (prop_value, str);
 }
 
diff --git a/libnm-core/nm-value-transforms.c b/libnm-core/nm-value-transforms.c
deleted file mode 100644
index 77d2609741..0000000000
--- a/libnm-core/nm-value-transforms.c
+++ /dev/null
@@ -1,112 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
-
-/*
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301 USA.
- *
- * Copyright 2005 - 2014 Red Hat, Inc.
- */
-
-#include "config.h"
-
-#include <string.h>
-
-#include "nm-utils.h"
-#include "nm-utils-private.h"
-#include "nm-dbus-glib-types.h"
-#include "nm-glib-compat.h"
-
-static void
-_nm_utils_convert_op_to_string (const GValue *src_value, GValue *dest_value)
-{
-	g_return_if_fail (g_type_is_a (G_VALUE_TYPE (src_value), DBUS_TYPE_G_OBJECT_PATH));
-
-	g_value_set_string (dest_value, (const char *) g_value_get_boxed (src_value));
-}
-
-static void
-_string_array_to_string (const GPtrArray *strings, GValue *dest_value)
-{
-	GString *printable;
-	guint i;
-
-	printable = g_string_new (NULL);
-	for (i = 0; strings && i < strings->len; i++) {
-		if (i > 0)
-			g_string_append_c (printable, ',');
-		g_string_append (printable, strings->pdata[i]);
-	}
-
-	g_value_take_string (dest_value, g_string_free (printable, FALSE));
-}
-
-static void
-_nm_utils_convert_op_array_to_string (const GValue *src_value, GValue *dest_value)
-{
-	const GPtrArray *strings;
-
-	g_return_if_fail (g_type_is_a (G_VALUE_TYPE (src_value), DBUS_TYPE_G_ARRAY_OF_OBJECT_PATH));
-
-	strings = (const GPtrArray *) g_value_get_boxed (src_value);
-	_string_array_to_string (strings, dest_value);
-}
-
-static void
-convert_one_gvalue_hash_entry (gpointer key, gpointer value, gpointer user_data)
-{
-	GString *printable = (GString *) user_data;
-	char *value_as_string;
-
-	value_as_string = g_strdup_value_contents ((GValue *) value);
-	g_string_append_printf (printable, " { '%s': %s },", (const char *) key, value_as_string);
-	g_free (value_as_string);
-}
-
-static void
-_nm_utils_convert_gvalue_hash_to_string (const GValue *src_value, GValue *dest_value)
-{
-	GHashTable *hash;
-	GString *printable;
-
-	g_return_if_fail (g_type_is_a (G_VALUE_TYPE (src_value), DBUS_TYPE_G_MAP_OF_VARIANT));
-
-	hash = (GHashTable *) g_value_get_boxed (src_value);
-
-	printable = g_string_new ("[");
-	g_hash_table_foreach (hash, convert_one_gvalue_hash_entry, printable);
-	g_string_append (printable, " ]");
-
-	g_value_take_string (dest_value, printable->str);
-	g_string_free (printable, FALSE);
-}
-
-void
-_nm_value_transforms_register (void)
-{
-	static gboolean registered = FALSE;
-
-	if (G_UNLIKELY (!registered)) {
-		g_value_register_transform_func (DBUS_TYPE_G_OBJECT_PATH,
-		                                 G_TYPE_STRING,
-		                                 _nm_utils_convert_op_to_string);
-		g_value_register_transform_func (DBUS_TYPE_G_ARRAY_OF_OBJECT_PATH,
-		                                 G_TYPE_STRING,
-		                                 _nm_utils_convert_op_array_to_string);
-		g_value_register_transform_func (DBUS_TYPE_G_MAP_OF_VARIANT,
-		                                 G_TYPE_STRING,
-		                                 _nm_utils_convert_gvalue_hash_to_string);
-		registered = TRUE;
-	}
-}
diff --git a/libnm-core/tests/test-compare.c b/libnm-core/tests/test-compare.c
index 5091403f02..e6ab047d64 100644
--- a/libnm-core/tests/test-compare.c
+++ b/libnm-core/tests/test-compare.c
@@ -21,9 +21,7 @@
 
 #include <arpa/inet.h>
 #include <netinet/in.h>
-#include <dbus/dbus-glib.h>
 
-#include "nm-dbus-glib-types.h"
 #include "nm-glib-compat.h"
 
 #include "nm-property-compare.h"
@@ -33,256 +31,152 @@
 static void
 compare_ints (void)
 {
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
+	GVariant *value1, *value2;
 
-	g_value_init (&value1, G_TYPE_INT);
-	g_value_init (&value2, G_TYPE_INT);
+	value1 = g_variant_new_int32 (5);
+	value2 = g_variant_new_int32 (5);
+	g_assert (nm_property_compare (value1, value2) == 0);
 
-	g_value_set_int (&value1, 5);
-	g_value_set_int (&value2, 5);
-	g_assert (nm_property_compare (&value1, &value2) == 0);
+	g_variant_unref (value2);
+	value2 = g_variant_new_int32 (10);
+	g_assert (nm_property_compare (value1, value2) < 0);
 
-	g_value_set_int (&value2, 10);
-	g_assert (nm_property_compare (&value1, &value2) < 0);
+	g_variant_unref (value2);
+	value2 = g_variant_new_int32 (-1);
+	g_assert (nm_property_compare (value1, value2) > 0);
 
-	g_value_set_int (&value2, 1);
-	g_assert (nm_property_compare (&value1, &value2) > 0);
+	g_variant_unref (value1);
+	g_variant_unref (value2);
 }
 
 static void
 compare_strings (void)
 {
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
+	GVariant *value1, *value2;
 	const char *str1 = "hello";
 	const char *str2 = "world";
 
-	g_value_init (&value1, G_TYPE_STRING);
-	g_value_init (&value2, G_TYPE_STRING);
+	value1 = g_variant_new_string (str1);
+	value2 = g_variant_new_string (str1);
+	g_assert (nm_property_compare (value1, value2) == 0);
 
-	g_value_set_string (&value1, str1);
-	g_value_set_string (&value2, str1);
-	g_assert (nm_property_compare (&value1, &value2) == 0);
+	g_variant_unref (value2);
+	value2 = g_variant_new_string (str2);
+	g_assert (nm_property_compare (value1, value2) < 0);
 
-	g_value_set_string (&value2, str2);
-	g_assert (nm_property_compare (&value1, &value2) < 0);
+	g_assert (nm_property_compare (value2, value1) > 0);
 
-	g_assert (nm_property_compare (&value2, &value1) > 0);
+	g_variant_unref (value1);
+	g_variant_unref (value2);
 }
 
 static void
 compare_strv (void)
 {
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
-	char *strv1[] = { "foo", "bar", "baz", NULL };
-	char *strv2[] = { "foo", "bar", "bar", NULL };
-	char *strv3[] = { "foo", "bar", NULL };
-	char *strv4[] = { "foo", "bar", "baz", "bam", NULL };
-
-	g_value_init (&value1, G_TYPE_STRV);
-	g_value_init (&value2, G_TYPE_STRV);
-
-	g_value_set_boxed (&value1, strv1);
-	g_value_set_boxed (&value2, strv1);
-	g_assert (nm_property_compare (&value1, &value2) == 0);
-
-	g_value_set_boxed (&value2, strv2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-
-	g_value_set_boxed (&value2, strv3);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-
-	g_value_set_boxed (&value2, strv4);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
+	GVariant *value1, *value2;
+	const char * const strv1[] = { "foo", "bar", "baz", NULL };
+	const char * const strv2[] = { "foo", "bar", "bar", NULL };
+	const char * const strv3[] = { "foo", "bar", NULL };
+	const char * const strv4[] = { "foo", "bar", "baz", "bam", NULL };
+
+	value1 = g_variant_new_strv (strv1, -1);
+	value2 = g_variant_new_strv (strv1, -1);
+	g_assert (nm_property_compare (value1, value2) == 0);
+
+	g_variant_unref (value2);
+	value2 = g_variant_new_strv (strv2, -1);
+	g_assert (nm_property_compare (value1, value2) != 0);
+
+	g_variant_unref (value2);
+	value2 = g_variant_new_strv (strv3, -1);
+	g_assert (nm_property_compare (value1, value2) != 0);
+
+	g_variant_unref (value2);
+	value2 = g_variant_new_strv (strv4, -1);
+	g_assert (nm_property_compare (value1, value2) != 0);
+
+	g_variant_unref (value1);
+	g_variant_unref (value2);
 }
 
 static void
-compare_garrays (void)
+compare_arrays (void)
 {
-	GArray *array1;
-	GArray *array2;
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
-	int i;
-
-	g_value_init (&value1, DBUS_TYPE_G_UINT_ARRAY);
-	array1 = g_array_new (FALSE, FALSE, sizeof (guint32));
-
-	g_value_init (&value2, DBUS_TYPE_G_UINT_ARRAY);
-	array2 = g_array_new (FALSE, FALSE, sizeof (guint32));
-
-	for (i = 0; i < 5; i++) {
-		g_array_append_val (array1, i);
-		g_array_append_val (array2, i);
-	}
-
-	g_value_set_boxed (&value1, array1);
-	g_value_set_boxed (&value2, array2);
-	g_assert (nm_property_compare (&value1, &value2) == 0);
-
-	g_array_remove_index (array2, 0);
-	g_value_set_boxed (&value2, array2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-
-	i = 7;
-	g_array_prepend_val (array2, i);
-	g_value_set_boxed (&value2, array2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-}
-
-static void
-compare_ptrarrays (void)
-{
-	GPtrArray *array1;
-	GPtrArray *array2;
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
-
-	g_value_init (&value1, dbus_g_type_get_collection ("GPtrArray", G_TYPE_STRING));
-	array1 = g_ptr_array_new ();
-
-	g_value_init (&value2, dbus_g_type_get_collection ("GPtrArray", G_TYPE_STRING));
-	array2 = g_ptr_array_new ();
-
-	g_ptr_array_add (array1, "hello");
-	g_ptr_array_add (array1, "world");
-	g_value_set_boxed (&value1, array1);
-
-	g_ptr_array_add (array2, "hello");
-	g_ptr_array_add (array2, "world");
-	g_value_set_boxed (&value2, array2);
-
-	g_assert (nm_property_compare (&value1, &value2) == 0);
-
-	g_ptr_array_add (array2, "boo");
-	g_value_set_boxed (&value2, array2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-
-	g_ptr_array_add (array1, "booz");
-	g_value_set_boxed (&value1, array1);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
+	GVariant *value1, *value2;
+	guint32 array[] = { 0, 1, 2, 3, 4 };
+
+	value1 = g_variant_new_fixed_array (G_VARIANT_TYPE_UINT32,
+	                                    array, G_N_ELEMENTS (array),
+	                                    sizeof (guint32));
+	value2 = g_variant_new_fixed_array (G_VARIANT_TYPE_UINT32,
+	                                    array, G_N_ELEMENTS (array),
+	                                    sizeof (guint32));
+
+	g_assert (nm_property_compare (value1, value2) == 0);
+
+	g_variant_unref (value2);
+	value2 = g_variant_new_fixed_array (G_VARIANT_TYPE_UINT32,
+	                                    array + 1, G_N_ELEMENTS (array) - 1,
+	                                    sizeof (guint32));
+	g_assert (nm_property_compare (value1, value2) != 0);
+
+	array[0] = 7;
+	g_variant_unref (value2);
+	value2 = g_variant_new_fixed_array (G_VARIANT_TYPE_UINT32,
+	                                    array, G_N_ELEMENTS (array),
+	                                    sizeof (guint32));
+	g_assert (nm_property_compare (value1, value2) != 0);
+
+	g_variant_unref (value1);
+	g_variant_unref (value2);
 }
 
 static void
 compare_str_hash (void)
 {
-	GHashTable *hash1;
-	GHashTable *hash2;
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
-
-	g_value_init (&value1, dbus_g_type_get_map ("GHashTable", G_TYPE_STRING, G_TYPE_STRING));
-	g_value_init (&value2, dbus_g_type_get_map ("GHashTable", G_TYPE_STRING, G_TYPE_STRING));
-
-	hash1 = g_hash_table_new (g_str_hash, g_str_equal);
-	hash2 = g_hash_table_new (g_str_hash, g_str_equal);
-
-	g_hash_table_insert (hash1, "key1", "hello");
-	g_hash_table_insert (hash1, "key2", "world");
-	g_hash_table_insert (hash1, "key3", "!");
-
-	g_hash_table_insert (hash2, "key3", "!");
-	g_hash_table_insert (hash2, "key2", "world");
-	g_hash_table_insert (hash2, "key1", "hello");
-
-	g_value_set_boxed (&value1, hash1);
-	g_value_set_boxed (&value2, hash2);
-	g_assert (nm_property_compare (&value1, &value2) == 0);
-
-	g_hash_table_remove (hash2, "key2");
-	g_value_set_boxed (&value2, hash2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-
-	g_hash_table_insert (hash2, "key2", "moon");
-	g_value_set_boxed (&value2, hash2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-}
-
-static GValue *
-str_to_gvalue (const char *str)
-{
-	GValue *value;
-
-	value = g_slice_new0 (GValue);
-	g_value_init (value, G_TYPE_STRING);
-	g_value_set_string (value, str);
-
-	return value;
-}
-
-static GValue *
-uint_to_gvalue (guint i)
-{
-	GValue *value;
-
-	value = g_slice_new0 (GValue);
-	g_value_init (value, G_TYPE_UINT);
-	g_value_set_uint (value, i);
-
-	return value;
-}
-
-static GValue *
-double_to_gvalue (double d)
-{
-	GValue *value;
-
-	value = g_slice_new0 (GValue);
-	g_value_init (value, G_TYPE_DOUBLE);
-	g_value_set_double (value, d);
-
-	return value;
-}
-
-static void
-compare_gvalue_hash (void)
-{
-	GHashTable *hash1;
-	GHashTable *hash2;
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
-
-	g_value_init (&value1, dbus_g_type_get_map ("GHashTable", G_TYPE_STRING, G_TYPE_VALUE));
-	g_value_init (&value2, dbus_g_type_get_map ("GHashTable", G_TYPE_STRING, G_TYPE_VALUE));
-
-	hash1 = g_hash_table_new (g_str_hash, g_str_equal);
-	hash2 = g_hash_table_new (g_str_hash, g_str_equal);
-
-	g_hash_table_insert (hash1, "key1", str_to_gvalue ("hello"));
-	g_hash_table_insert (hash1, "key2", uint_to_gvalue (5));
-	g_hash_table_insert (hash1, "key3", double_to_gvalue (123.456));
-
-	g_hash_table_insert (hash2, "key3", double_to_gvalue (123.456));
-	g_hash_table_insert (hash2, "key2", uint_to_gvalue (5));
-	g_hash_table_insert (hash2, "key1", str_to_gvalue ("hello"));
-
-	g_value_set_boxed (&value1, hash1);
-	g_value_set_boxed (&value2, hash2);
-	g_assert (nm_property_compare (&value1, &value2) == 0);
-
-	g_hash_table_remove (hash2, "key2");
-	g_value_set_boxed (&value2, hash2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-
-	g_hash_table_insert (hash2, "key2", str_to_gvalue ("moon"));
-	g_value_set_boxed (&value2, hash2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
+	GVariant *value1, *value2;
+	GVariantBuilder builder;
+
+	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{ss}"));
+	g_variant_builder_add (&builder, "{ss}", "key1", "hello");
+	g_variant_builder_add (&builder, "{ss}", "key2", "world");
+	g_variant_builder_add (&builder, "{ss}", "key3", "!");
+	value1 = g_variant_builder_end (&builder);
+
+	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{ss}"));
+	g_variant_builder_add (&builder, "{ss}", "key3", "!");
+	g_variant_builder_add (&builder, "{ss}", "key2", "world");
+	g_variant_builder_add (&builder, "{ss}", "key1", "hello");
+	value2 = g_variant_builder_end (&builder);
+
+	g_assert (nm_property_compare (value1, value2) == 0);
+
+	g_variant_unref (value2);
+	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{ss}"));
+	g_variant_builder_add (&builder, "{ss}", "key1", "hello");
+	g_variant_builder_add (&builder, "{ss}", "key3", "!");
+	value2 = g_variant_builder_end (&builder);
+
+	g_assert (nm_property_compare (value1, value2) != 0);
+	g_assert (nm_property_compare (value2, value1) != 0);
+
+	g_variant_unref (value2);
+	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{ss}"));
+	g_variant_builder_add (&builder, "{ss}", "key1", "hello");
+	g_variant_builder_add (&builder, "{ss}", "key2", "moon");
+	g_variant_builder_add (&builder, "{ss}", "key3", "!");
+	value2 = g_variant_builder_end (&builder);
+
+	g_assert (nm_property_compare (value1, value2) != 0);
+
+	g_variant_unref (value1);
+	g_variant_unref (value2);
 }
 
 static void
 compare_ip6_addresses (void)
 {
-	GValueArray *array1;
-	GValueArray *array2;
-	GValueArray *array3;
-	GByteArray *ba1;
-	GByteArray *ba2;
-	GByteArray *ba3;
-	GValue element = G_VALUE_INIT;
-	GValue value1 = G_VALUE_INIT;
-	GValue value2 = G_VALUE_INIT;
+	GVariant *value1, *value2;
 	struct in6_addr addr1;
 	struct in6_addr addr2;
 	struct in6_addr addr3;
@@ -294,86 +188,44 @@ compare_ip6_addresses (void)
 	inet_pton (AF_INET6, "ffff:2:3:4:5:6:7:8", &addr2);
 	inet_pton (AF_INET6, "::", &addr3);
 
-	/* address 1 */
-	array1 = g_value_array_new (2);
-
-	ba1 = g_byte_array_new ();
-	g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-	g_byte_array_append (ba1, (guint8 *) addr1.s6_addr, 16);
-	g_value_take_boxed (&element, ba1);
-	g_value_array_append (array1, &element);
-	g_value_unset (&element);
-
-	g_value_init (&element, G_TYPE_UINT);
-	g_value_set_uint (&element, prefix1);
-	g_value_array_append (array1, &element);
-	g_value_unset (&element);
-
-	ba1 = g_byte_array_new ();
-	g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-	g_byte_array_append (ba1, (guint8 *) addr3.s6_addr, 16);
-	g_value_take_boxed (&element, ba1);
-	g_value_array_append (array1, &element);
-	g_value_unset (&element);
-
-	/* address 2 */
-	array2 = g_value_array_new (2);
-
-	ba2 = g_byte_array_new ();
-	g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-	g_byte_array_append (ba2, (guint8 *) addr2.s6_addr, 16);
-	g_value_take_boxed (&element, ba2);
-	g_value_array_append (array2, &element);
-	g_value_unset (&element);
-
-	g_value_init (&element, G_TYPE_UINT);
-	g_value_set_uint (&element, prefix2);
-	g_value_array_append (array2, &element);
-	g_value_unset (&element);
-
-	ba2 = g_byte_array_new ();
-	g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-	g_byte_array_append (ba2, (guint8 *) addr3.s6_addr, 16);
-	g_value_take_boxed (&element, ba2);
-	g_value_array_append (array2, &element);
-	g_value_unset (&element);
-
-	/* address 3 */
-	array3 = g_value_array_new (2);
-
-	ba3 = g_byte_array_new ();
-	g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-	g_byte_array_append (ba3, (guint8 *) addr3.s6_addr, 16);
-	g_value_take_boxed (&element, ba3);
-	g_value_array_append (array3, &element);
-	g_value_unset (&element);
-
-	g_value_init (&element, G_TYPE_UINT);
-	g_value_set_uint (&element, prefix3);
-	g_value_array_append (array3, &element);
-	g_value_unset (&element);
-
-	ba3 = g_byte_array_new ();
-	g_value_init (&element, DBUS_TYPE_G_UCHAR_ARRAY);
-	g_byte_array_append (ba3, (guint8 *) addr3.s6_addr, 16);
-	g_value_take_boxed (&element, ba3);
-	g_value_array_append (array3, &element);
-	g_value_unset (&element);
-
-	g_value_init (&value1, DBUS_TYPE_G_IP6_ADDRESS);
-	g_value_init (&value2, DBUS_TYPE_G_IP6_ADDRESS);
-
-	g_value_set_boxed (&value1, array1);
-	g_value_set_boxed (&value2, array1);
-	g_assert (nm_property_compare (&value1, &value2) == 0);
-
-	g_value_set_boxed (&value1, array1);
-	g_value_set_boxed (&value2, array2);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
-
-	g_value_set_boxed (&value1, array1);
-	g_value_set_boxed (&value2, array3);
-	g_assert (nm_property_compare (&value1, &value2) != 0);
+	value1 = g_variant_new ("(@ayu@ay)",
+	                        g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                   (guint8 *) addr1.s6_addr, 16, 1),
+	                        prefix1,
+	                        g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                   (guint8 *) addr3.s6_addr, 16, 1));
+
+	value2 = g_variant_new ("(@ayu@ay)",
+	                        g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                   (guint8 *) addr1.s6_addr, 16, 1),
+	                        prefix1,
+	                        g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                   (guint8 *) addr3.s6_addr, 16, 1));
+
+	g_assert (nm_property_compare (value1, value2) == 0);
+
+	g_variant_unref (value2);
+	value2 = g_variant_new ("(@ayu@ay)",
+	                        g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                   (guint8 *) addr2.s6_addr, 16, 1),
+	                        prefix2,
+	                        g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                   (guint8 *) addr3.s6_addr, 16, 1));
+
+	g_assert (nm_property_compare (value1, value2) != 0);
+
+	g_variant_unref (value2);
+	value2 = g_variant_new ("(@ayu@ay)",
+	                        g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                   (guint8 *) addr3.s6_addr, 16, 1),
+	                        prefix3,
+	                        g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                   (guint8 *) addr3.s6_addr, 16, 1));
+
+	g_assert (nm_property_compare (value1, value2) != 0);
+
+	g_variant_unref (value1);
+	g_variant_unref (value2);
 }
 
 NMTST_DEFINE ();
@@ -386,10 +238,8 @@ main (int argc, char *argv[])
 	g_test_add_func ("/libnm/compare/ints", compare_ints);
 	g_test_add_func ("/libnm/compare/strings", compare_strings);
 	g_test_add_func ("/libnm/compare/strv", compare_strv);
-	g_test_add_func ("/libnm/compare/garrays", compare_garrays);
-	g_test_add_func ("/libnm/compare/ptrarrays", compare_ptrarrays);
+	g_test_add_func ("/libnm/compare/arrays", compare_arrays);
 	g_test_add_func ("/libnm/compare/str_hash", compare_str_hash);
-	g_test_add_func ("/libnm/compare/gvalue_hash", compare_gvalue_hash);
 	g_test_add_func ("/libnm/compare/ip6_addresses", compare_ip6_addresses);
 
 	return g_test_run ();
diff --git a/libnm-core/tests/test-general.c b/libnm-core/tests/test-general.c
index a46a3cf905..a098fc452a 100644
--- a/libnm-core/tests/test-general.c
+++ b/libnm-core/tests/test-general.c
@@ -20,7 +20,6 @@
  */
 
 #include <glib.h>
-#include <dbus/dbus-glib.h>
 #include <string.h>
 
 #include <nm-utils.h>
@@ -40,7 +39,6 @@
 #include "nm-setting-bond.h"
 #include "nm-utils.h"
 #include "nm-core-internal.h"
-#include "nm-dbus-glib-types.h"
 
 #include "nm-test-utils.h"
 
@@ -181,8 +179,8 @@ test_setting_vpn_update_secrets (void)
 {
 	NMConnection *connection;
 	NMSettingVpn *s_vpn;
-	GHashTable *settings, *vpn, *secrets;
-	GValue val = G_VALUE_INIT;
+	GVariantBuilder settings_builder, vpn_builder, secrets_builder;
+	GVariant *settings;
 	gboolean success;
 	GError *error = NULL;
 	const char *tmp;
@@ -202,18 +200,20 @@ test_setting_vpn_update_secrets (void)
 	        "error creating vpn setting");
 	nm_connection_add_setting (connection, NM_SETTING (s_vpn));
 
-	settings = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, (GDestroyNotify) g_hash_table_destroy);
-	vpn = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, (GDestroyNotify) g_value_unset);
-	g_hash_table_insert (settings, NM_SETTING_VPN_SETTING_NAME, vpn);
+	g_variant_builder_init (&settings_builder, NM_VARIANT_TYPE_CONNECTION);
+	g_variant_builder_init (&vpn_builder, NM_VARIANT_TYPE_SETTING);
+	g_variant_builder_init (&secrets_builder, G_VARIANT_TYPE ("a{ss}"));
 
-	secrets = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, NULL);
-	g_value_init (&val, DBUS_TYPE_G_MAP_OF_STRING);
-	g_value_take_boxed (&val, secrets);
-	g_hash_table_insert (vpn, NM_SETTING_VPN_SECRETS, &val);
+	g_variant_builder_add (&secrets_builder, "{ss}", key1, val1);
+	g_variant_builder_add (&secrets_builder, "{ss}", key2, val2);
 
-	/* Add some secrets */
-	g_hash_table_insert (secrets, (char *) key1, (char *) val1);
-	g_hash_table_insert (secrets, (char *) key2, (char *) val2);
+	g_variant_builder_add (&vpn_builder, "{sv}",
+	                       NM_SETTING_VPN_SECRETS,
+	                       g_variant_builder_end (&secrets_builder));
+	g_variant_builder_add (&settings_builder, "{sa{sv}}",
+	                       NM_SETTING_VPN_SETTING_NAME,
+	                       &vpn_builder);
+	settings = g_variant_builder_end (&settings_builder);
 
 	success = nm_connection_update_secrets (connection, NM_SETTING_VPN_SETTING_NAME, settings, &error);
 	ASSERT (success == TRUE,
@@ -232,7 +232,7 @@ test_setting_vpn_update_secrets (void)
 	ASSERT (strcmp (tmp, val2) == 0,
 	        "vpn-update-secrets", "unexpected key #2 value");
 
-	g_hash_table_destroy (settings);
+	g_variant_unref (settings);
 	g_object_unref (connection);
 }
 
@@ -581,27 +581,42 @@ make_test_wsec_setting (const char *detail)
 	return s_wsec;
 }
 
+#define ASSERT_CONTAINS(vardict, key, test_name, msg) \
+	{ \
+		GVariant *value; \
+		value = g_variant_lookup_value (vardict, key, NULL); \
+		ASSERT (value != NULL, test_name, msg); \
+		g_variant_unref (value); \
+	}
+
+#define ASSERT_NOT_CONTAINS(vardict, key, test_name, msg) \
+	{ \
+		GVariant *value; \
+		value = g_variant_lookup_value (vardict, key, NULL); \
+		ASSERT (value == NULL, test_name, msg); \
+	}
+
 static void
 test_setting_to_dbus_all (void)
 {
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *hash;
+	GVariant *dict;
 
 	s_wsec = make_test_wsec_setting ("setting-to-dbus-all");
 
-	hash = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_ALL);
+	dict = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_ALL);
 
 	/* Make sure all keys are there */
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT),
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
 	        "setting-to-dbus-all", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_KEY_MGMT);
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME),
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME,
 	        "setting-to-dbus-all", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME);
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_PSK),
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_PSK,
 	        "setting-to-dbus-all", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_PSK);
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0),
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
 	        "setting-to-dbus-all", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_WEP_KEY0);
 
-	g_hash_table_destroy (hash);
+	g_variant_unref (dict);
 	g_object_unref (s_wsec);
 }
 
@@ -609,25 +624,25 @@ static void
 test_setting_to_dbus_no_secrets (void)
 {
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *hash;
+	GVariant *dict;
 
 	s_wsec = make_test_wsec_setting ("setting-to-dbus-no-secrets");
 
-	hash = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_NO_SECRETS);
+	dict = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_NO_SECRETS);
 
 	/* Make sure non-secret keys are there */
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT),
-	        "setting-to-dbus-no-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_KEY_MGMT);
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME),
-	        "setting-to-dbus-no-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME);
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
+	                 "setting-to-dbus-no-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_KEY_MGMT);
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME,
+	                 "setting-to-dbus-no-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME);
 
 	/* Make sure secrets are not there */
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_PSK) == NULL,
-	        "setting-to-dbus-no-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_PSK);
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0) == NULL,
-	        "setting-to-dbus-no-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_WEP_KEY0);
+	ASSERT_NOT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_PSK,
+	                     "setting-to-dbus-no-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_PSK);
+	ASSERT_NOT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
+	                     "setting-to-dbus-no-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_WEP_KEY0);
 
-	g_hash_table_destroy (hash);
+	g_variant_unref (dict);
 	g_object_unref (s_wsec);
 }
 
@@ -635,25 +650,25 @@ static void
 test_setting_to_dbus_only_secrets (void)
 {
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *hash;
+	GVariant *dict;
 
 	s_wsec = make_test_wsec_setting ("setting-to-dbus-only-secrets");
 
-	hash = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
+	dict = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
 
-	/* Make sure non-secret keys are there */
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT) == NULL,
-	        "setting-to-dbus-only-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_KEY_MGMT);
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME) == NULL,
-	        "setting-to-dbus-only-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME);
+	/* Make sure non-secret keys are not there */
+	ASSERT_NOT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
+	                     "setting-to-dbus-only-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_KEY_MGMT);
+	ASSERT_NOT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME,
+	                     "setting-to-dbus-only-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME);
 
-	/* Make sure secrets are not there */
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_PSK),
-	        "setting-to-dbus-only-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_PSK);
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0),
-	        "setting-to-dbus-only-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_WEP_KEY0);
+	/* Make sure secrets are there */
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_PSK,
+	                 "setting-to-dbus-only-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_PSK);
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
+	                 "setting-to-dbus-only-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_WEP_KEY0);
 
-	g_hash_table_destroy (hash);
+	g_variant_unref (dict);
 	g_object_unref (s_wsec);
 }
 
@@ -661,11 +676,11 @@ static void
 test_setting_to_dbus_transform (void)
 {
 	NMSetting *s_wired;
-	GHashTable *hash;
-	GValue *val;
+	GVariant *dict, *val;
 	const char *test_mac_address = "11:22:33:44:55:66";
-	GByteArray *dbus_mac_address;
-	GByteArray *cmp_mac_address;
+	const guint8 *dbus_mac_address;
+	guint8 cmp_mac_address[ETH_ALEN];
+	gsize len;
 
 	s_wired = nm_setting_wired_new ();
 	g_object_set (s_wired,
@@ -674,22 +689,20 @@ test_setting_to_dbus_transform (void)
 
 	g_assert_cmpstr (nm_setting_wired_get_mac_address (NM_SETTING_WIRED (s_wired)), ==, test_mac_address);
 
-	hash = _nm_setting_to_dbus (s_wired, NULL, NM_CONNECTION_SERIALIZE_ALL);
-	g_assert (hash != NULL);
+	dict = _nm_setting_to_dbus (s_wired, NULL, NM_CONNECTION_SERIALIZE_ALL);
+	g_assert (dict != NULL);
 
-	val = g_hash_table_lookup (hash, NM_SETTING_WIRED_MAC_ADDRESS);
+	val = g_variant_lookup_value (dict, NM_SETTING_WIRED_MAC_ADDRESS, G_VARIANT_TYPE_BYTESTRING);
 	g_assert (val != NULL);
-	g_assert (G_VALUE_HOLDS (val, DBUS_TYPE_G_UCHAR_ARRAY));
 
-	dbus_mac_address = g_value_get_boxed (val);
+	dbus_mac_address = g_variant_get_fixed_array (val, &len, 1);
+	g_assert_cmpint (len, ==, ETH_ALEN);
 
-	cmp_mac_address = nm_utils_hwaddr_atoba (test_mac_address, ETH_ALEN);
+	nm_utils_hwaddr_aton (test_mac_address, cmp_mac_address, ETH_ALEN);
+	g_assert (memcmp (dbus_mac_address, cmp_mac_address, ETH_ALEN) == 0);
 
-	g_assert_cmpint (dbus_mac_address->len, ==, cmp_mac_address->len);
-	g_assert (memcmp (dbus_mac_address->data, cmp_mac_address->data, ETH_ALEN) == 0);
-
-	g_byte_array_unref (cmp_mac_address);
-	g_hash_table_unref (hash);
+	g_variant_unref (val);
+	g_variant_unref (dict);
 	g_object_unref (s_wired);
 }
 
@@ -698,21 +711,21 @@ test_connection_to_dbus_setting_name (void)
 {
 	NMConnection *connection;
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *hash;
+	GVariant *dict;
 
 	connection = nm_simple_connection_new ();
 	s_wsec = make_test_wsec_setting ("connection-to-dbus-setting-name");
 	nm_connection_add_setting (connection, NM_SETTING (s_wsec));
 
-	hash = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
 
-	/* Make sure the keys of the first level hash are setting names, not
+	/* Make sure the keys of the first level dict are setting names, not
 	 * the GType name of the setting objects.
 	 */
-	ASSERT (g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME) != NULL,
-	        "connection-to-dbus-setting-name", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
+	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
+	                 "connection-to-dbus-setting-name", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
 
-	g_hash_table_destroy (hash);
+	g_variant_unref (dict);
 	g_object_unref (connection);
 }
 
@@ -723,8 +736,7 @@ test_connection_to_dbus_deprecated_props (void)
 	NMSetting *s_wireless;
 	GBytes *ssid;
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *hash, *wireless_hash;
-	GValue *sec_val;
+	GVariant *dict, *wireless_dict, *sec_val;
 
 	connection = nmtst_create_minimal_connection ("test-connection-to-dbus-deprecated-props",
 	                                              NULL,
@@ -739,33 +751,36 @@ test_connection_to_dbus_deprecated_props (void)
 	g_bytes_unref (ssid);
 	nm_connection_add_setting (connection, s_wireless);
 
-	/* Hash should not have an 802-11-wireless.security property */
-	hash = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
-	g_assert (hash != NULL);
+	/* Serialization should not have an 802-11-wireless.security property */
+	dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	g_assert (dict != NULL);
 
-	wireless_hash = g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SETTING_NAME);
-	g_assert (wireless_hash != NULL);
+	wireless_dict = g_variant_lookup_value (dict, NM_SETTING_WIRELESS_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+	g_assert (wireless_dict != NULL);
 
-	sec_val = g_hash_table_lookup (wireless_hash, "security");
+	sec_val = g_variant_lookup_value (wireless_dict, "security", NULL);
 	g_assert (sec_val == NULL);
 
-	g_hash_table_destroy (hash);
+	g_variant_unref (wireless_dict);
+	g_variant_unref (dict);
 
 	/* Now add an NMSettingWirelessSecurity and try again */
 	s_wsec = make_test_wsec_setting ("test-connection-to-dbus-deprecated-props");
 	nm_connection_add_setting (connection, NM_SETTING (s_wsec));
 
-	hash = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
-	g_assert (hash != NULL);
+	dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	g_assert (dict != NULL);
 
-	wireless_hash = g_hash_table_lookup (hash, NM_SETTING_WIRELESS_SETTING_NAME);
-	g_assert (wireless_hash != NULL);
+	wireless_dict = g_variant_lookup_value (dict, NM_SETTING_WIRELESS_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+	g_assert (wireless_dict != NULL);
 
-	sec_val = g_hash_table_lookup (wireless_hash, "security");
-	g_assert (G_VALUE_HOLDS_STRING (sec_val));
-	g_assert_cmpstr (g_value_get_string (sec_val), ==, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
+	sec_val = g_variant_lookup_value (wireless_dict, "security", NULL);
+	g_assert (g_variant_is_of_type (sec_val, G_VARIANT_TYPE_STRING));
+	g_assert_cmpstr (g_variant_get_string (sec_val, NULL), ==, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
 
-	g_hash_table_destroy (hash);
+	g_variant_unref (sec_val);
+	g_variant_unref (wireless_dict);
+	g_variant_unref (dict);
 	g_object_unref (connection);
 }
 
@@ -773,14 +788,14 @@ static void
 test_setting_new_from_dbus (void)
 {
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *hash;
+	GVariant *dict;
 
-	s_wsec = make_test_wsec_setting ("setting-to-dbus-all");
-	hash = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_ALL);
+	s_wsec = make_test_wsec_setting ("setting-new-from-dbus");
+	dict = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_ALL);
 	g_object_unref (s_wsec);
 
-	s_wsec = (NMSettingWirelessSecurity *) _nm_setting_new_from_dbus (NM_TYPE_SETTING_WIRELESS_SECURITY, hash, NULL, NULL);
-	g_hash_table_destroy (hash);
+	s_wsec = (NMSettingWirelessSecurity *) _nm_setting_new_from_dbus (NM_TYPE_SETTING_WIRELESS_SECURITY, dict, NULL, NULL);
+	g_variant_unref (dict);
 
 	g_assert (s_wsec);
 	g_assert_cmpstr (nm_setting_wireless_security_get_key_mgmt (s_wsec), ==, "wpa-psk");
@@ -793,25 +808,27 @@ static void
 test_setting_new_from_dbus_transform (void)
 {
 	NMSetting *s_wired;
-	GHashTable *hash;
-	GValue val = { 0, };
+	GVariant *dict;
+	GVariantBuilder builder;
 	const char *test_mac_address = "11:22:33:44:55:66";
-	GByteArray *dbus_mac_address;
+	guint8 dbus_mac_address[ETH_ALEN];
 	GError *error = NULL;
 
-	hash = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, (GDestroyNotify) g_value_unset);
+	nm_utils_hwaddr_aton (test_mac_address, dbus_mac_address, ETH_ALEN);
 
-	dbus_mac_address = nm_utils_hwaddr_atoba (test_mac_address, ETH_ALEN);
-	g_value_init (&val, DBUS_TYPE_G_UCHAR_ARRAY);
-	g_value_take_boxed (&val, dbus_mac_address);
-	g_hash_table_insert (hash, NM_SETTING_WIRED_MAC_ADDRESS, &val);
+	g_variant_builder_init (&builder, NM_VARIANT_TYPE_SETTING);
+	g_variant_builder_add (&builder, "{sv}",
+	                       NM_SETTING_WIRED_MAC_ADDRESS,
+	                       g_variant_new_fixed_array (G_VARIANT_TYPE_BYTE,
+	                                                  dbus_mac_address, ETH_ALEN, 1));
+	dict = g_variant_builder_end (&builder);
 
-	s_wired = _nm_setting_new_from_dbus (NM_TYPE_SETTING_WIRED, hash, NULL, &error);
+	s_wired = _nm_setting_new_from_dbus (NM_TYPE_SETTING_WIRED, dict, NULL, &error);
 	g_assert_no_error (error);
 
 	g_assert_cmpstr (nm_setting_wired_get_mac_address (NM_SETTING_WIRED (s_wired)), ==, test_mac_address);
 
-	g_hash_table_unref (hash);
+	g_variant_unref (dict);
 	g_object_unref (s_wired);
 }
 
@@ -852,73 +869,61 @@ new_test_connection (void)
 	return connection;
 }
 
-static GValue *
-string_to_gvalue (const char *str)
-{
-	GValue *val;
-
-	val = g_slice_new0 (GValue);
-	g_value_init (val, G_TYPE_STRING);
-	g_value_set_string (val, str);
-	return val;
-}
-
-static void
-destroy_gvalue (gpointer data)
-{
-	g_value_unset ((GValue *) data);
-	g_slice_free (GValue, data);
-}
-
-static GHashTable *
-new_connection_hash (char **out_uuid,
+static GVariant *
+new_connection_dict (char **out_uuid,
                      const char **out_expected_id,
                      const char **out_expected_ip6_method)
 {
-	GHashTable *hash;
-	GHashTable *setting;
+	GVariantBuilder conn_builder, setting_builder;
 
-	hash = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, (GDestroyNotify) g_hash_table_destroy);
+	g_variant_builder_init (&conn_builder, NM_VARIANT_TYPE_CONNECTION);
 
 	*out_uuid = nm_utils_uuid_generate ();
 	*out_expected_id = "My happy connection";
 	*out_expected_ip6_method = NM_SETTING_IP6_CONFIG_METHOD_LINK_LOCAL;
 
 	/* Connection setting */
-	setting = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, destroy_gvalue);
-	g_hash_table_insert (setting,
-	                     g_strdup (NM_SETTING_NAME),
-	                     string_to_gvalue (NM_SETTING_CONNECTION_SETTING_NAME));
-	g_hash_table_insert (setting,
-	                     g_strdup (NM_SETTING_CONNECTION_ID),
-	                     string_to_gvalue (*out_expected_id));
-	g_hash_table_insert (setting,
-	                     g_strdup (NM_SETTING_CONNECTION_UUID),
-	                     string_to_gvalue (*out_uuid));
-	g_hash_table_insert (setting,
-	                     g_strdup (NM_SETTING_CONNECTION_TYPE),
-	                     string_to_gvalue (NM_SETTING_WIRED_SETTING_NAME));
-	g_hash_table_insert (hash, g_strdup (NM_SETTING_CONNECTION_SETTING_NAME), setting);
+	g_variant_builder_init (&setting_builder, NM_VARIANT_TYPE_SETTING);
+	g_variant_builder_add (&setting_builder, "{sv}",
+	                       NM_SETTING_NAME,
+	                       g_variant_new_string (NM_SETTING_CONNECTION_SETTING_NAME));
+	g_variant_builder_add (&setting_builder, "{sv}",
+	                       NM_SETTING_CONNECTION_ID,
+	                       g_variant_new_string (*out_expected_id));
+	g_variant_builder_add (&setting_builder, "{sv}",
+	                       NM_SETTING_CONNECTION_UUID,
+	                       g_variant_new_string (*out_uuid));
+	g_variant_builder_add (&setting_builder, "{sv}",
+	                       NM_SETTING_CONNECTION_TYPE,
+	                       g_variant_new_string (NM_SETTING_WIRED_SETTING_NAME));
+
+	g_variant_builder_add (&conn_builder, "{sa{sv}}",
+	                       NM_SETTING_CONNECTION_SETTING_NAME,
+	                       &setting_builder);
 
 	/* Wired setting */
-	setting = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, destroy_gvalue);
-	g_hash_table_insert (hash, g_strdup (NM_SETTING_WIRED_SETTING_NAME), setting);
+	g_variant_builder_init (&setting_builder, NM_VARIANT_TYPE_SETTING);
+	g_variant_builder_add (&conn_builder, "{sa{sv}}",
+	                       NM_SETTING_WIRED_SETTING_NAME,
+	                       &setting_builder);
 
 	/* IP6 */
-	setting = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, destroy_gvalue);
-	g_hash_table_insert (setting,
-	                     g_strdup (NM_SETTING_IP6_CONFIG_METHOD),
-	                     string_to_gvalue (*out_expected_ip6_method));
-	g_hash_table_insert (hash, g_strdup (NM_SETTING_IP6_CONFIG_SETTING_NAME), setting);
+	g_variant_builder_init (&setting_builder, NM_VARIANT_TYPE_SETTING);
+	g_variant_builder_add (&setting_builder, "{sv}",
+	                       NM_SETTING_IP6_CONFIG_METHOD,
+	                       g_variant_new_string (*out_expected_ip6_method));
+	g_variant_builder_add (&conn_builder, "{sa{sv}}",
+	                       NM_SETTING_IP6_CONFIG_SETTING_NAME,
+	                       &setting_builder);
 
-	return hash;
+	return g_variant_builder_end (&conn_builder);
 }
 
 static void
 test_connection_replace_settings ()
 {
 	NMConnection *connection;
-	GHashTable *new_settings;
+	GVariant *new_settings;
 	GError *error = NULL;
 	gboolean success;
 	NMSettingConnection *s_con;
@@ -928,7 +933,7 @@ test_connection_replace_settings ()
 
 	connection = new_test_connection ();
 
-	new_settings = new_connection_hash (&uuid, &expected_id, &expected_method);
+	new_settings = new_connection_dict (&uuid, &expected_id, &expected_method);
 	g_assert (new_settings);
 
 	/* Replace settings and test */
@@ -949,7 +954,7 @@ test_connection_replace_settings ()
 	g_assert_cmpstr (nm_setting_ip6_config_get_method (s_ip6), ==, expected_method);
 
 	g_free (uuid);
-	g_hash_table_destroy (new_settings);
+	g_variant_unref (new_settings);
 	g_object_unref (connection);
 }
 
@@ -1014,7 +1019,8 @@ static void
 test_connection_replace_settings_bad (void)
 {
 	NMConnection *connection, *new_connection;
-	GHashTable *new_settings, *setting_hash;
+	GVariant *new_settings;
+	GVariantBuilder builder, setting_builder;
 	GError *error = NULL;
 	gboolean success;
 	NMSettingConnection *s_con;
@@ -1047,10 +1053,15 @@ test_connection_replace_settings_bad (void)
 	g_assert_cmpstr (nm_connection_get_id (connection), ==, "bad-connection");
 	g_assert (!nm_connection_verify (connection, NULL));
 	g_object_unref (connection);
+	g_variant_unref (new_settings);
 
-	/* But given an invalid hash, it should fail */
-	setting_hash = g_hash_table_new (g_str_hash, g_str_equal);
-	g_hash_table_insert (new_settings, g_strdup ("ip-over-avian-carrier"), setting_hash);
+	/* But given an invalid dict, it should fail */
+	g_variant_builder_init (&builder, NM_VARIANT_TYPE_CONNECTION);
+	g_variant_builder_init (&setting_builder, NM_VARIANT_TYPE_SETTING);
+	g_variant_builder_add (&builder, "{sa{sv}}",
+	                       "ip-over-avian-carrier",
+	                       &setting_builder);
+	new_settings = g_variant_builder_end (&builder);
 
 	connection = new_test_connection ();
 	success = nm_connection_replace_settings (connection, new_settings, &error);
@@ -1060,7 +1071,7 @@ test_connection_replace_settings_bad (void)
 	g_assert (nm_connection_verify (connection, NULL));
 	g_object_unref (connection);
 
-	g_hash_table_unref (new_settings);
+	g_variant_unref (new_settings);
 	g_object_unref (new_connection);
 }
 
@@ -1068,14 +1079,14 @@ static void
 test_connection_new_from_dbus ()
 {
 	NMConnection *connection;
-	GHashTable *new_settings;
+	GVariant *new_settings;
 	GError *error = NULL;
 	NMSettingConnection *s_con;
 	NMSettingIP6Config *s_ip6;
 	char *uuid = NULL;
 	const char *expected_id = NULL, *expected_method = NULL;
 
-	new_settings = new_connection_hash (&uuid, &expected_id, &expected_method);
+	new_settings = new_connection_dict (&uuid, &expected_id, &expected_method);
 	g_assert (new_settings);
 
 	/* Replace settings and test */
@@ -1096,7 +1107,7 @@ test_connection_new_from_dbus ()
 	g_assert_cmpstr (nm_setting_ip6_config_get_method (s_ip6), ==, expected_method);
 
 	g_free (uuid);
-	g_hash_table_destroy (new_settings);
+	g_variant_unref (new_settings);
 	g_object_unref (connection);
 }
 
@@ -2633,13 +2644,14 @@ test_setting_old_uuid (void)
 
 /*
  * Test normalization of interface-name
- **/
+ */
 static void
 test_connection_normalize_virtual_iface_name (void)
 {
 	NMConnection *con = NULL;
 	NMSettingConnection *s_con;
 	NMSettingVlan *s_vlan;
+	GVariant *connection_dict, *setting_dict, *var;
 	GHashTable *connection_hash, *setting_hash;
 	GValue *value;
 	GError *error = NULL;
@@ -2671,27 +2683,38 @@ test_connection_normalize_virtual_iface_name (void)
 
 	g_assert_cmpstr (nm_connection_get_interface_name (con), ==, IFACE_NAME);
 
-	connection_hash = nm_connection_to_dbus (con, NM_CONNECTION_SERIALIZE_ALL);
+	connection_dict = nm_connection_to_dbus (con, NM_CONNECTION_SERIALIZE_ALL);
 	g_object_unref (con);
 
 	/* Serialized form should include vlan.interface-name as well. */
-	setting_hash = g_hash_table_lookup (connection_hash, NM_SETTING_VLAN_SETTING_NAME);
-	g_assert (setting_hash != NULL);
-	value = g_hash_table_lookup (setting_hash, "interface-name");
-	g_assert (value != NULL);
-	g_assert (G_VALUE_HOLDS_STRING (value));
-	g_assert_cmpstr (g_value_get_string (value), ==, IFACE_NAME);
+	setting_dict = g_variant_lookup_value (connection_dict, NM_SETTING_VLAN_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+	g_assert (setting_dict != NULL);
+	var = g_variant_lookup_value (setting_dict, "interface-name", NULL);
+	g_assert (var != NULL);
+	g_assert (g_variant_is_of_type (var, G_VARIANT_TYPE_STRING));
+	g_assert_cmpstr (g_variant_get_string (var, NULL), ==, IFACE_NAME);
+
+	g_variant_unref (setting_dict);
+	g_variant_unref (var);
 
 	/* If vlan.interface-name is invalid, deserialization will fail. */
+	connection_hash = _nm_utils_connection_dict_to_hash (connection_dict);
+	setting_hash = g_hash_table_lookup (connection_hash, NM_SETTING_VLAN_SETTING_NAME);
+	value = g_hash_table_lookup (setting_hash, "interface-name");
 	g_value_set_string (value, ":::this-is-not-a-valid-interface-name:::");
-	con = nm_simple_connection_new_from_dbus (connection_hash, &error);
+	g_variant_unref (connection_dict);
+	connection_dict = _nm_utils_connection_hash_to_dict (connection_hash);
+
+	con = nm_simple_connection_new_from_dbus (connection_dict, &error);
 	g_assert_error (error, NM_SETTING_CONNECTION_ERROR, NM_SETTING_CONNECTION_ERROR_INVALID_PROPERTY);
 	g_clear_error (&error);
 
 	/* If vlan.interface-name is valid, but doesn't match, it will be ignored. */
 	g_value_set_string (value, IFACE_VIRT);
+	g_variant_unref (connection_dict);
+	connection_dict = _nm_utils_connection_hash_to_dict (connection_hash);
 
-	con = nm_simple_connection_new_from_dbus (connection_hash, &error);
+	con = nm_simple_connection_new_from_dbus (connection_dict, &error);
 	g_assert_no_error (error);
 
 	g_assert_cmpstr (nm_connection_get_interface_name (con), ==, IFACE_NAME);
@@ -2705,8 +2728,10 @@ test_connection_normalize_virtual_iface_name (void)
 	setting_hash = g_hash_table_lookup (connection_hash, NM_SETTING_CONNECTION_SETTING_NAME);
 	g_assert (setting_hash != NULL);
 	g_hash_table_remove (setting_hash, NM_SETTING_CONNECTION_INTERFACE_NAME);
+	g_variant_unref (connection_dict);
+	connection_dict = _nm_utils_connection_hash_to_dict (connection_hash);
 
-	con = nm_simple_connection_new_from_dbus (connection_hash, &error);
+	con = nm_simple_connection_new_from_dbus (connection_dict, &error);
 	g_assert_no_error (error);
 
 	g_assert_cmpstr (nm_connection_get_interface_name (con), ==, IFACE_VIRT);
@@ -2714,6 +2739,7 @@ test_connection_normalize_virtual_iface_name (void)
 	g_assert_cmpstr (nm_setting_connection_get_interface_name (s_con), ==, IFACE_VIRT);
 	g_object_unref (con);
 
+	g_variant_unref (connection_dict);
 	g_hash_table_unref (connection_hash);
 }
 
diff --git a/libnm-core/tests/test-secrets.c b/libnm-core/tests/test-secrets.c
index 22aa460ebc..544af6bca0 100644
--- a/libnm-core/tests/test-secrets.c
+++ b/libnm-core/tests/test-secrets.c
@@ -22,8 +22,6 @@
 #include <glib.h>
 #include <string.h>
 
-#include <nm-utils.h>
-
 #include "nm-setting-connection.h"
 #include "nm-setting-wired.h"
 #include "nm-setting-8021x.h"
@@ -35,6 +33,8 @@
 #include "nm-setting-ppp.h"
 #include "nm-setting-pppoe.h"
 #include "nm-setting-vpn.h"
+#include "nm-utils.h"
+#include "nm-utils-private.h"
 
 #include "nm-test-utils.h"
 
@@ -441,15 +441,6 @@ wifi_connection_new (void)
 	return connection;
 }
 
-static void
-value_destroy (gpointer data)
-{
-	GValue *value = (GValue *) data;
-
-	g_value_unset (value);
-	g_slice_free (GValue, value);
-}
-
 static GValue *
 string_to_gvalue (const char *str)
 {
@@ -460,15 +451,20 @@ string_to_gvalue (const char *str)
 	return val;
 }
 
-static GValue *
-uint_to_gvalue (guint32 i)
+static GVariant *
+build_wep_secrets (const char *wepkey)
 {
-	GValue *val;
+	GVariantBuilder builder;
 
-	val = g_slice_new0 (GValue);
-	g_value_init (val, G_TYPE_UINT);
-	g_value_set_uint (val, i);
-	return val;
+	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{sv}"));
+	g_variant_builder_add (&builder, "{sv}",
+	                       NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
+	                       g_variant_new_string (wepkey));
+	g_variant_builder_add (&builder, "{sv}",
+	                       NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE,
+	                       g_variant_new_uint32 (NM_WEP_KEY_TYPE_KEY));
+
+	return g_variant_builder_end (&builder);
 }
 
 static void
@@ -476,7 +472,7 @@ test_update_secrets_wifi_single_setting (void)
 {
 	NMConnection *connection;
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *secrets;
+	GVariant *secrets;
 	GError *error = NULL;
 	gboolean success;
 	const char *wepkey = "11111111111111111111111111";
@@ -486,11 +482,7 @@ test_update_secrets_wifi_single_setting (void)
 
 	connection = wifi_connection_new ();
 
-	/* Build up the secrets hash */
-	secrets = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, value_destroy);
-	g_hash_table_insert (secrets, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, string_to_gvalue (wepkey));
-	g_hash_table_insert (secrets, NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE, uint_to_gvalue (NM_WEP_KEY_TYPE_KEY));
-
+	secrets = build_wep_secrets (wepkey);
 	success = nm_connection_update_secrets (connection,
 	                                        NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
 	                                        secrets,
@@ -498,6 +490,8 @@ test_update_secrets_wifi_single_setting (void)
 	g_assert_no_error (error);
 	g_assert (success);
 
+	g_variant_unref (secrets);
+
 	/* Make sure the secret is now in the connection */
 	s_wsec = nm_connection_get_setting_wireless_security (connection);
 	g_assert (s_wsec);
@@ -512,7 +506,8 @@ test_update_secrets_wifi_full_hash (void)
 {
 	NMConnection *connection;
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *secrets, *all;
+	GVariantBuilder builder;
+	GVariant *all;
 	GError *error = NULL;
 	gboolean success;
 	const char *wepkey = "11111111111111111111111111";
@@ -524,12 +519,11 @@ test_update_secrets_wifi_full_hash (void)
 
 	connection = wifi_connection_new ();
 
-	/* Build up the secrets hash */
-	all = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, (GDestroyNotify) g_hash_table_destroy);
-	secrets = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, value_destroy);
-	g_hash_table_insert (secrets, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, string_to_gvalue (wepkey));
-	g_hash_table_insert (secrets, NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE, uint_to_gvalue (NM_WEP_KEY_TYPE_KEY));
-	g_hash_table_insert (all, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME, secrets);
+	g_variant_builder_init (&builder, NM_VARIANT_TYPE_CONNECTION);
+	g_variant_builder_add (&builder, "{s@a{sv}}",
+	                       NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
+	                       build_wep_secrets (wepkey));
+	all = g_variant_builder_end (&builder);
 
 	success = nm_connection_update_secrets (connection,
 	                                        NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
@@ -538,6 +532,8 @@ test_update_secrets_wifi_full_hash (void)
 	g_assert_no_error (error);
 	g_assert (success);
 
+	g_variant_unref (all);
+
 	/* Make sure the secret is now in the connection */
 	s_wsec = nm_connection_get_setting_wireless_security (connection);
 	g_assert (s_wsec);
@@ -551,7 +547,7 @@ static void
 test_update_secrets_wifi_bad_setting_name (void)
 {
 	NMConnection *connection;
-	GHashTable *secrets;
+	GVariant *secrets;
 	GError *error = NULL;
 	gboolean success;
 	const char *wepkey = "11111111111111111111111111";
@@ -562,10 +558,7 @@ test_update_secrets_wifi_bad_setting_name (void)
 
 	connection = wifi_connection_new ();
 
-	/* Build up the secrets hash */
-	secrets = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, value_destroy);
-	g_hash_table_insert (secrets, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, string_to_gvalue (wepkey));
-	g_hash_table_insert (secrets, NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE, uint_to_gvalue (NM_WEP_KEY_TYPE_KEY));
+	secrets = build_wep_secrets (wepkey);
 
 	success = nm_connection_update_secrets (connection,
 	                                        "asdfasdfasdfasf",
@@ -574,6 +567,8 @@ test_update_secrets_wifi_bad_setting_name (void)
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
 	g_assert (success == FALSE);
 
+	g_variant_unref (secrets);
+
 	g_object_unref (connection);
 }
 
@@ -582,7 +577,8 @@ test_update_secrets_whole_connection (void)
 {
 	NMConnection *connection;
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *secrets, *wsec_hash;
+	GVariant *secrets;
+	GHashTable *secrets_hash, *wsec_hash;
 	GError *error = NULL;
 	gboolean success;
 	const char *wepkey = "11111111111111111111111111";
@@ -593,16 +589,21 @@ test_update_secrets_whole_connection (void)
 
 	connection = wifi_connection_new ();
 
-	/* Build up the secrets hash */
+	/* Build up the secrets dictionary */
 	secrets = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
-	wsec_hash = g_hash_table_lookup (secrets, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
+	secrets_hash = _nm_utils_connection_dict_to_hash (secrets);
+	wsec_hash = g_hash_table_lookup (secrets_hash, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
 	g_assert (wsec_hash);
 	g_hash_table_insert (wsec_hash, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, string_to_gvalue (wepkey));
+	g_variant_unref (secrets);
+	secrets = _nm_utils_connection_hash_to_dict (secrets_hash);
 
 	success = nm_connection_update_secrets (connection, NULL, secrets, &error);
 	g_assert_no_error (error);
 	g_assert (success == TRUE);
 
+	g_variant_unref (secrets);
+
 	s_wsec = nm_connection_get_setting_wireless_security (connection);
 	g_assert (s_wsec);
 	g_assert_cmpstr (nm_setting_wireless_security_get_wep_key (s_wsec, 0), ==, wepkey);
@@ -614,17 +615,18 @@ static void
 test_update_secrets_whole_connection_empty_hash (void)
 {
 	NMConnection *connection;
-	GHashTable *secrets;
+	GVariant *secrets;
 	GError *error = NULL;
 	gboolean success;
 
 	/* Test that updating secrets with an empty hash returns success */
 
 	connection = wifi_connection_new ();
-	secrets = g_hash_table_new (g_str_hash, g_str_equal);
+	secrets = g_variant_new_array (G_VARIANT_TYPE ("{sv}"), NULL, 0);
 	success = nm_connection_update_secrets (connection, NULL, secrets, &error);
 	g_assert_no_error (error);
 	g_assert (success == TRUE);
+	g_variant_unref (secrets);
 	g_object_unref (connection);
 }
 
@@ -632,7 +634,11 @@ static void
 test_update_secrets_whole_connection_bad_setting (void)
 {
 	NMConnection *connection;
-	GHashTable *secrets, *wsec_hash;
+	NMSettingWirelessSecurity *s_wsec;
+	GVariant *secrets, *copy, *setting_hash;
+	const char *setting_name;
+	GVariantBuilder conn_builder;
+	GVariantIter conn_iter;
 	GError *error = NULL;
 	gboolean success;
 	const char *wepkey = "11111111111111111111111111";
@@ -642,25 +648,36 @@ test_update_secrets_whole_connection_bad_setting (void)
 	 */
 
 	connection = wifi_connection_new ();
+	s_wsec = nm_connection_get_setting_wireless_security (connection);
+	g_assert (s_wsec != NULL);
+	g_object_set (G_OBJECT (s_wsec),
+	              NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, wepkey,
+	              NULL);
 
 	/* Build up the secrets hash */
 	secrets = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
-	wsec_hash = g_hash_table_lookup (secrets, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
-	g_assert (wsec_hash);
-	g_hash_table_insert (wsec_hash, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, string_to_gvalue (wepkey));
 
-	/* Steal the wsec setting hash so it's not deallocated, and stuff it back
-	 * in with a different name so we ensure libnm is returning the right
-	 * error when it finds an entry in the connection hash that doesn't match
-	 * any setting in the connection.
+	/* Copy the dict, renaming the wireless-security setting in the process
+	 * (so we ensure libnm is returning the right error when it finds an entry
+	 * in the connection hash that doesn't match any setting in the connection).
 	 */
-	g_hash_table_steal (secrets, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
-	g_hash_table_insert (secrets, "asdfasdfasdfasdf", wsec_hash);
+	g_variant_builder_init (&conn_builder, NM_VARIANT_TYPE_CONNECTION);
+	g_variant_iter_init (&conn_iter, secrets);
+	while (g_variant_iter_next (&conn_iter, "{&s@a{sv}}", &setting_name, &setting_hash)) {
+		if (strcmp (setting_name, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME) == 0)
+			setting_name = "asdfasdfasdfasdf";
+
+		g_variant_builder_add (&conn_builder, "{s@a{sv}}", setting_name, setting_hash);
+		g_variant_unref (setting_hash);
+	}
+	copy = g_variant_builder_end (&conn_builder);
+	g_variant_unref (secrets);
 
-	success = nm_connection_update_secrets (connection, NULL, secrets, &error);
+	success = nm_connection_update_secrets (connection, NULL, copy, &error);
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
 	g_assert (success == FALSE);
 
+	g_variant_unref (copy);
 	g_object_unref (connection);
 }
 
@@ -668,7 +685,7 @@ static void
 test_update_secrets_whole_connection_empty_base_setting (void)
 {
 	NMConnection *connection;
-	GHashTable *secrets;
+	GVariant *secrets, *setting;
 	GError *error = NULL;
 	gboolean success;
 
@@ -678,8 +695,11 @@ test_update_secrets_whole_connection_empty_base_setting (void)
 
 	connection = wifi_connection_new ();
 	secrets = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
-	g_assert_cmpint (g_hash_table_size (secrets), ==, 3);
-	g_assert (g_hash_table_lookup (secrets, NM_SETTING_WIRELESS_SETTING_NAME));
+	g_assert_cmpint (g_variant_n_children (secrets), ==, 3);
+
+	setting = g_variant_lookup_value (secrets, NM_SETTING_WIRELESS_SETTING_NAME, NULL);
+	g_assert (setting != NULL);
+	g_variant_unref (setting);
 
 	success = nm_connection_update_secrets (connection,
 	                                        NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
@@ -688,7 +708,7 @@ test_update_secrets_whole_connection_empty_base_setting (void)
 	g_assert_no_error (error);
 	g_assert (success);
 
-	g_hash_table_destroy (secrets);
+	g_variant_unref (secrets);
 	g_object_unref (connection);
 }
 
@@ -696,7 +716,7 @@ static void
 test_update_secrets_null_setting_name_with_setting_hash (void)
 {
 	NMConnection *connection;
-	GHashTable *secrets;
+	GVariant *secrets;
 	GError *error = NULL;
 	gboolean success;
 	const char *wepkey = "11111111111111111111111111";
@@ -705,15 +725,13 @@ test_update_secrets_null_setting_name_with_setting_hash (void)
 
 	connection = wifi_connection_new ();
 
-	secrets = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, value_destroy);
-	g_hash_table_insert (secrets, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, string_to_gvalue (wepkey));
-	g_hash_table_insert (secrets, NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE, uint_to_gvalue (NM_WEP_KEY_TYPE_KEY));
+	secrets = build_wep_secrets (wepkey);
 
 	success = nm_connection_update_secrets (connection, NULL, secrets, &error);
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
 	g_assert (!success);
 
-	g_hash_table_destroy (secrets);
+	g_variant_unref (secrets);
 	g_object_unref (connection);
 }
 
diff --git a/libnm/nm-client.c b/libnm/nm-client.c
index d4a7456d4d..9d30d74249 100644
--- a/libnm/nm-client.c
+++ b/libnm/nm-client.c
@@ -34,6 +34,7 @@
 #include "nm-object-cache.h"
 #include "nm-dbus-glib-types.h"
 #include "nm-glib-compat.h"
+#include "nm-utils-private.h"
 
 void _nm_device_wifi_set_wireless_enabled (NMDeviceWifi *device, gboolean enabled);
 
@@ -717,8 +718,13 @@ nm_client_add_and_activate_connection (NMClient *client,
 	info->user_data = user_data;
 	info->client = client;
 
-	if (partial)
-		hash = nm_connection_to_dbus (partial, NM_CONNECTION_SERIALIZE_ALL);
+	if (partial) {
+		GVariant *dict;
+
+		dict = nm_connection_to_dbus (partial, NM_CONNECTION_SERIALIZE_ALL);
+		hash = _nm_utils_connection_dict_to_hash (dict);
+		g_variant_unref (dict);
+	}
 	if (!hash)
 		hash = g_hash_table_new (g_str_hash, g_str_equal);
 
diff --git a/libnm/nm-remote-connection.c b/libnm/nm-remote-connection.c
index 08e61c93bd..7551f92d04 100644
--- a/libnm/nm-remote-connection.c
+++ b/libnm/nm-remote-connection.c
@@ -32,6 +32,7 @@
 #include "nm-dbus-glib-types.h"
 #include "nm-glib-compat.h"
 #include "nm-dbus-helpers.h"
+#include "nm-utils-private.h"
 
 static void nm_remote_connection_connection_iface_init (NMConnectionInterface *iface);
 static void nm_remote_connection_initable_iface_init (GInitableIface *iface);
@@ -211,6 +212,7 @@ nm_remote_connection_commit_changes (NMRemoteConnection *self,
 {
 	NMRemoteConnectionPrivate *priv;
 	RemoteCall *call;
+	GVariant *settings_dict;
 	GHashTable *settings;
 
 	g_return_if_fail (NM_IS_REMOTE_CONNECTION (self));
@@ -221,7 +223,10 @@ nm_remote_connection_commit_changes (NMRemoteConnection *self,
 	if (!call)
 		return;
 
-	settings = nm_connection_to_dbus (NM_CONNECTION (self), NM_CONNECTION_SERIALIZE_ALL);
+	settings_dict = nm_connection_to_dbus (NM_CONNECTION (self), NM_CONNECTION_SERIALIZE_ALL);
+	settings = _nm_utils_connection_dict_to_hash (settings_dict);
+	g_variant_unref (settings_dict);
+
 	call->call = dbus_g_proxy_begin_call (priv->proxy, "Update",
 	                                      remote_call_dbus_cb, call, NULL,
 	                                      DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT, settings,
@@ -248,7 +253,8 @@ nm_remote_connection_commit_changes_unsaved (NMRemoteConnection *connection,
                                              gpointer user_data)
 {
 	NMRemoteConnectionPrivate *priv;
-	GHashTable *settings = NULL;
+	GVariant *settings_dict;
+	GHashTable *settings;
 	RemoteCall *call;
 
 	g_return_if_fail (NM_IS_REMOTE_CONNECTION (connection));
@@ -259,7 +265,9 @@ nm_remote_connection_commit_changes_unsaved (NMRemoteConnection *connection,
 	if (!call)
 		return;
 
-	settings = nm_connection_to_dbus (NM_CONNECTION (connection), NM_CONNECTION_SERIALIZE_ALL);
+	settings_dict = nm_connection_to_dbus (NM_CONNECTION (connection), NM_CONNECTION_SERIALIZE_ALL);
+	settings = _nm_utils_connection_dict_to_hash (settings_dict);
+	g_variant_unref (settings_dict);
 	call->call = dbus_g_proxy_begin_call (priv->proxy, "UpdateUnsaved",
 	                                      remote_call_dbus_cb, call, NULL,
 	                                      DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT, settings,
@@ -342,8 +350,19 @@ get_secrets_cb (RemoteCall *call, DBusGProxyCall *proxy_call, GError *error)
 		                       G_TYPE_INVALID);
 		error = local_error;
 	}
-	if (func)
-		(*func) (call->self, error ? NULL : secrets, error, call->user_data);
+	if (func) {
+		GVariant *secrets_dict;
+
+		if (secrets)
+			secrets_dict = _nm_utils_connection_hash_to_dict (secrets);
+		else
+			secrets_dict = NULL;
+
+		(*func) (call->self, error ? NULL : secrets_dict, error, call->user_data);
+
+		if (secrets_dict)
+			g_variant_unref (secrets_dict);
+	}
 	g_clear_error (&local_error);
 	if (secrets)
 		g_hash_table_destroy (secrets);
@@ -431,8 +450,10 @@ static void
 replace_settings (NMRemoteConnection *self, GHashTable *new_settings)
 {
 	GError *error = NULL;
+	GVariant *new_settings_dict;
 
-	if (!nm_connection_replace_settings (NM_CONNECTION (self), new_settings, &error)) {
+	new_settings_dict = _nm_utils_connection_hash_to_dict (new_settings);
+	if (!nm_connection_replace_settings (NM_CONNECTION (self), new_settings_dict, &error)) {
 		g_warning ("%s: error updating connection %s settings: (%d) %s",
 		           __func__,
 		           nm_connection_get_path (NM_CONNECTION (self)),
@@ -440,6 +461,7 @@ replace_settings (NMRemoteConnection *self, GHashTable *new_settings)
 		           (error && error->message) ? error->message : "(unknown)");
 		g_clear_error (&error);
 	}
+	g_variant_unref (new_settings_dict);
 }
 
 static void
diff --git a/libnm/nm-remote-connection.h b/libnm/nm-remote-connection.h
index d5668298a7..fc5b87d8a0 100644
--- a/libnm/nm-remote-connection.h
+++ b/libnm/nm-remote-connection.h
@@ -89,9 +89,8 @@ typedef NMRemoteConnectionResultFunc NMRemoteConnectionDeleteFunc;
 /**
  * NMRemoteConnectionGetSecretsFunc:
  * @connection: the connection for which secrets were requested
- * @secrets: (element-type utf8 GLib.HashTable): on success, a hash table of
- *  hash tables, with each inner hash mapping a setting property to a #GValue
- *  containing that property's value
+ * @secrets: on success, a #GVariant of type %NM_VARIANT_TYPE_CONNECTION
+ *  containing secrets.
  * @error: on failure, a descriptive error
  * @user_data: user data passed to nm_remote_connection_get_secrets()
  *
@@ -99,7 +98,7 @@ typedef NMRemoteConnectionResultFunc NMRemoteConnectionDeleteFunc;
  * secrets via nm_remote_connection_get_secrets().
  */
 typedef void (*NMRemoteConnectionGetSecretsFunc) (NMRemoteConnection *connection,
-                                                  GHashTable *secrets,
+                                                  GVariant *secrets,
                                                   GError *error,
                                                   gpointer user_data);
 
diff --git a/libnm/nm-remote-settings.c b/libnm/nm-remote-settings.c
index 7cf2c85743..c3684ea814 100644
--- a/libnm/nm-remote-settings.c
+++ b/libnm/nm-remote-settings.c
@@ -467,6 +467,7 @@ nm_remote_settings_add_connection (NMRemoteSettings *settings,
 {
 	NMRemoteSettingsPrivate *priv;
 	AddConnectionInfo *info;
+	GVariant *new_settings_dict;
 	GHashTable *new_settings;
 
 	g_return_val_if_fail (NM_IS_REMOTE_SETTINGS (settings), FALSE);
@@ -483,7 +484,8 @@ nm_remote_settings_add_connection (NMRemoteSettings *settings,
 	info->callback = callback;
 	info->callback_data = user_data;
 
-	new_settings = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	new_settings_dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	new_settings = _nm_utils_connection_dict_to_hash (new_settings_dict);
 	dbus_g_proxy_begin_call (priv->proxy, "AddConnection",
 	                         add_connection_done,
 	                         info,
@@ -491,6 +493,7 @@ nm_remote_settings_add_connection (NMRemoteSettings *settings,
 	                         DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT, new_settings,
 	                         G_TYPE_INVALID);
 	g_hash_table_destroy (new_settings);
+	g_variant_unref (new_settings_dict);
 
 	priv->add_list = g_slist_append (priv->add_list, info);
 
@@ -520,6 +523,7 @@ nm_remote_settings_add_connection_unsaved (NMRemoteSettings *settings,
 {
 	NMRemoteSettingsPrivate *priv;
 	AddConnectionInfo *info;
+	GVariant *new_settings_dict;
 	GHashTable *new_settings;
 
 	g_return_val_if_fail (NM_IS_REMOTE_SETTINGS (settings), FALSE);
@@ -536,7 +540,8 @@ nm_remote_settings_add_connection_unsaved (NMRemoteSettings *settings,
 	info->callback = callback;
 	info->callback_data = user_data;
 
-	new_settings = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	new_settings_dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	new_settings = _nm_utils_connection_dict_to_hash (new_settings_dict);
 	dbus_g_proxy_begin_call (priv->proxy, "AddConnectionUnsaved",
 	                         add_connection_done,
 	                         info,
@@ -544,6 +549,7 @@ nm_remote_settings_add_connection_unsaved (NMRemoteSettings *settings,
 	                         DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT, new_settings,
 	                         G_TYPE_INVALID);
 	g_hash_table_destroy (new_settings);
+	g_variant_unref (new_settings_dict);
 
 	priv->add_list = g_slist_append (priv->add_list, info);
 
diff --git a/libnm/nm-secret-agent.c b/libnm/nm-secret-agent.c
index ef204eb655..2e3616a95e 100644
--- a/libnm/nm-secret-agent.c
+++ b/libnm/nm-secret-agent.c
@@ -28,6 +28,7 @@
 #include "nm-enum-types.h"
 #include "nm-dbus-helpers.h"
 #include "nm-simple-connection.h"
+#include "nm-utils-private.h"
 
 static void impl_secret_agent_get_secrets (NMSecretAgent *self,
                                            GHashTable *connection_hash,
@@ -324,6 +325,7 @@ verify_request (NMSecretAgent *self,
                 GError **error)
 {
 	NMConnection *connection = NULL;
+	GVariant *connection_dict;
 	GError *local = NULL;
 
 	if (!verify_sender (self, context, error))
@@ -344,7 +346,9 @@ verify_request (NMSecretAgent *self,
 
 	/* Make sure the given connection is valid */
 	g_assert (out_connection);
-	connection = nm_simple_connection_new_from_dbus (connection_hash, &local);
+	connection_dict = _nm_utils_connection_hash_to_dict (connection_hash);
+	connection = nm_simple_connection_new_from_dbus (connection_dict, &local);
+	g_variant_unref (connection_dict);
 	if (connection) {
 		nm_connection_set_path (connection, connection_path);
 		*out_connection = connection;
@@ -364,7 +368,7 @@ verify_request (NMSecretAgent *self,
 static void
 get_secrets_cb (NMSecretAgent *self,
                 NMConnection *connection,
-                GHashTable *secrets,
+                GVariant *secrets,
                 GError *error,
                 gpointer user_data)
 {
@@ -372,8 +376,13 @@ get_secrets_cb (NMSecretAgent *self,
 
 	if (error)
 		dbus_g_method_return_error (info->context, error);
-	else
-		dbus_g_method_return (info->context, secrets);
+	else {
+		GHashTable *secrets_hash;
+
+		secrets_hash = _nm_utils_connection_dict_to_hash (secrets);
+		dbus_g_method_return (info->context, secrets_hash);
+		g_hash_table_unref (secrets_hash);
+	}
 
 	/* Remove the request from internal tracking */
 	get_secrets_info_finalize (self, info);
diff --git a/libnm/nm-secret-agent.h b/libnm/nm-secret-agent.h
index 4b88d55be7..90fcc7d7e1 100644
--- a/libnm/nm-secret-agent.h
+++ b/libnm/nm-secret-agent.h
@@ -83,13 +83,12 @@ typedef struct {
  * note that this object will be unrefed after the callback has returned, use
  * g_object_ref()/g_object_unref() if you want to use this object after the callback
  * has returned
- * @secrets: (element-type utf8 GLib.HashTable): the #GHashTable containing
- * the requested secrets in the same format as an #NMConnection hash (as
- * created by nm_connection_to_dbus() for example).  Each key in @secrets
+ * @secrets: the #GVariant of type %NM_VARIANT_TYPE_CONNECTION containing the requested
+ * secrets (as created by nm_connection_to_dbus() for example).  Each key in @secrets
  * should be the name of a #NMSetting object (like "802-11-wireless-security")
- * and each value should be a #GHashTable.  The sub-hashes map string:#GValue
- * where the string is the setting property name (like "psk") and the value
- * is the secret
+ * and each value should be an %NM_VARIANT_TYPE_SETTING variant.  The sub-dicts
+ * map string:value, where the string is the setting property name (like "psk")
+ * and the value is the secret
  * @error: if the secrets request failed, give a descriptive error here
  * @user_data: caller-specific data to be passed to the function
  *
@@ -98,14 +97,14 @@ typedef struct {
  * return them, or to return an error, this function should be called with
  * those secrets or the error.
  *
- * To easily create the hash table to return the Wi-Fi PSK, you could do
+ * To easily create the dictionary to return the Wi-Fi PSK, you could do
  * something like this:
  * <example>
- *  <title>Creating a secrets hash</title>
+ *  <title>Creating a secrets dictionary</title>
  *  <programlisting>
  *   NMConnection *secrets;
  *   NMSettingWirelessSecurity *s_wsec;
- *   GHashTable *secrets_hash;
+ *   GVariant *secrets_dict;
  *
  *   secrets = nm_connection_new ();
  *   s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new ();
@@ -113,18 +112,18 @@ typedef struct {
  *                 NM_SETTING_WIRELESS_SECURITY_PSK, "my really cool PSK",
  *                 NULL);
  *   nm_connection_add_setting (secrets, NM_SETTING (s_wsec));
- *   secrets_hash = nm_connection_to_dbus (secrets, NM_CONNECTION_SERIALIZE_ALL);
+ *   secrets_dict = nm_connection_to_dbus (secrets, NM_CONNECTION_SERIALIZE_ALL);
  *
- *   (call the NMSecretAgentGetSecretsFunc with secrets_hash)
+ *   (call the NMSecretAgentGetSecretsFunc with secrets_dict)
  *
  *   g_object_unref (secrets);
- *   g_hash_table_unref (secrets_hash);
+ *   g_variant_unref (secrets_dict);
  *  </programlisting>
  * </example>
  */
 typedef void (*NMSecretAgentGetSecretsFunc) (NMSecretAgent *agent,
                                              NMConnection *connection,
-                                             GHashTable *secrets,
+                                             GVariant *secrets,
                                              GError *error,
                                              gpointer user_data);
 
diff --git a/libnm/nm-vpn-plugin.c b/libnm/nm-vpn-plugin.c
index 7171aaf311..961a85b94b 100644
--- a/libnm/nm-vpn-plugin.c
+++ b/libnm/nm-vpn-plugin.c
@@ -29,6 +29,8 @@
 #include "nm-enum-types.h"
 #include "nm-utils.h"
 #include "nm-dbus-glib-types.h"
+#include "nm-utils-private.h"
+#include "nm-connection.h"
 
 static gboolean impl_vpn_plugin_connect    (NMVpnPlugin *plugin,
                                             GHashTable *connection,
@@ -439,6 +441,7 @@ _connect_generic (NMVpnPlugin *plugin,
 {
 	NMVpnPluginPrivate *priv = NM_VPN_PLUGIN_GET_PRIVATE (plugin);
 	NMVpnPluginClass *vpn_class = NM_VPN_PLUGIN_GET_CLASS (plugin);
+	GVariant *properties_dict;
 	NMConnection *connection;
 	gboolean success = FALSE;
 	GError *local = NULL;
@@ -451,7 +454,9 @@ _connect_generic (NMVpnPlugin *plugin,
 		return FALSE;
 	}
 
-	connection = nm_simple_connection_new_from_dbus (properties, &local);
+	properties_dict = _nm_utils_connection_hash_to_dict (properties);
+	connection = nm_simple_connection_new_from_dbus (properties_dict, &local);
+	g_variant_unref (properties_dict);
 	if (!connection) {
 		g_set_error (error, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 		             "Invalid connection: (%d) %s",
@@ -516,6 +521,7 @@ impl_vpn_plugin_need_secrets (NMVpnPlugin *plugin,
                               GError **err)
 {
 	gboolean ret = FALSE;
+	GVariant *properties_dict;
 	NMConnection *connection;
 	char *sn = NULL;
 	GError *ns_err = NULL;
@@ -525,7 +531,9 @@ impl_vpn_plugin_need_secrets (NMVpnPlugin *plugin,
 	g_return_val_if_fail (NM_IS_VPN_PLUGIN (plugin), FALSE);
 	g_return_val_if_fail (properties != NULL, FALSE);
 
-	connection = nm_simple_connection_new_from_dbus (properties, &cnfh_err);
+	properties_dict = _nm_utils_connection_hash_to_dict (properties);
+	connection = nm_simple_connection_new_from_dbus (properties_dict, &cnfh_err);
+	g_variant_unref (properties_dict);
 	if (!connection) {
 		g_set_error (err,
 		             NM_VPN_PLUGIN_ERROR,
@@ -569,6 +577,7 @@ impl_vpn_plugin_new_secrets (NMVpnPlugin *plugin,
                              GError **error)
 {
 	NMVpnPluginPrivate *priv = NM_VPN_PLUGIN_GET_PRIVATE (plugin);
+	GVariant *properties_dict;
 	NMConnection *connection;
 	GError *local = NULL;
 	gboolean success;
@@ -580,7 +589,9 @@ impl_vpn_plugin_new_secrets (NMVpnPlugin *plugin,
 		return FALSE;
 	}
 
-	connection = nm_simple_connection_new_from_dbus (properties, &local);
+	properties_dict = _nm_utils_connection_hash_to_dict (properties);
+	connection = nm_simple_connection_new_from_dbus (properties_dict, &local);
+	g_variant_unref (properties_dict);
 	if (!connection) {
 		g_set_error (error, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 		             "Invalid connection: (%d) %s",
diff --git a/libnm/tests/test-secret-agent.c b/libnm/tests/test-secret-agent.c
index bd540124c6..342ad4baf3 100644
--- a/libnm/tests/test-secret-agent.c
+++ b/libnm/tests/test-secret-agent.c
@@ -61,8 +61,8 @@ test_secret_agent_get_secrets (NMSecretAgent                 *agent,
                                gpointer                       callback_data)
 {
 	NMSettingWirelessSecurity *s_wsec;
-	GHashTable *hash = NULL, *setting_hash;
-	GValue value = G_VALUE_INIT;
+	GVariant *secrets = NULL;
+	GVariantBuilder secrets_builder, setting_builder;
 	char *secret = NULL;
 	GError *error = NULL;
 
@@ -92,20 +92,21 @@ test_secret_agent_get_secrets (NMSecretAgent                 *agent,
 		goto done;
 	}
 
-	hash = g_hash_table_new_full (g_str_hash, g_str_equal,
-	                              NULL, (GDestroyNotify) g_hash_table_unref);
-	setting_hash = g_hash_table_new (g_str_hash, g_str_equal);
-	g_hash_table_insert (hash, (char *) setting_name, setting_hash);
+	g_variant_builder_init (&setting_builder, NM_VARIANT_TYPE_SETTING);
+	g_variant_builder_add (&setting_builder, "{sv}",
+	                       NM_SETTING_WIRELESS_SECURITY_PSK,
+	                       g_variant_new_string (secret));
 
-	g_value_init (&value, G_TYPE_STRING);
-	g_value_set_string (&value, secret);
-
-	g_hash_table_insert (setting_hash, NM_SETTING_WIRELESS_SECURITY_PSK, &value);
+	g_variant_builder_init (&secrets_builder, NM_VARIANT_TYPE_CONNECTION);
+	g_variant_builder_add (&secrets_builder, "{sa{sv}}",
+	                       setting_name,
+	                       &setting_builder);
+	secrets = g_variant_ref_sink (g_variant_builder_end (&secrets_builder));
 
 done:
-	callback (agent, connection, hash, error, callback_data);
+	callback (agent, connection, secrets, error, callback_data);
 	g_clear_error (&error);
-	g_clear_pointer (&hash, g_hash_table_unref);
+	g_clear_pointer (&secrets, g_variant_unref);
 	g_free (secret);
 }
 
diff --git a/src/nm-dispatcher.c b/src/nm-dispatcher.c
index 752b1baf04..d614dd849d 100644
--- a/src/nm-dispatcher.c
+++ b/src/nm-dispatcher.c
@@ -28,6 +28,7 @@
 #include "nm-dispatcher-api.h"
 #include "NetworkManagerUtils.h"
 #include "nm-utils.h"
+#include "nm-utils-private.h"
 #include "nm-logging.h"
 #include "nm-dbus-manager.h"
 #include "nm-device.h"
@@ -471,7 +472,11 @@ _dispatcher_call (DispatcherAction action,
 	}
 
 	if (connection) {
-		connection_hash = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_NO_SECRETS);
+		GVariant *connection_dict;
+
+		connection_dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_NO_SECRETS);
+		connection_hash = _nm_utils_connection_dict_to_hash (connection_dict);
+		g_variant_unref (connection_dict);
 
 		connection_props = value_hash_create ();
 		value_hash_add_object_path (connection_props,
diff --git a/src/nm-manager.c b/src/nm-manager.c
index 09a994c63f..f429066767 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -52,6 +52,7 @@
 #include "nm-manager-auth.h"
 #include "NetworkManagerUtils.h"
 #include "nm-utils.h"
+#include "nm-utils-private.h"
 #include "nm-device-factory.h"
 #include "nm-enum-types.h"
 #include "nm-sleep-monitor.h"
@@ -3296,8 +3297,12 @@ impl_manager_add_and_activate_connection (NMManager *self,
 	 * validate_activation_request()).
 	 */
 	connection = nm_simple_connection_new ();
-	if (settings && g_hash_table_size (settings))
-		nm_connection_replace_settings (connection, settings, NULL);
+	if (settings && g_hash_table_size (settings)) {
+		GVariant *settings_dict = _nm_utils_connection_hash_to_dict (settings);
+
+		nm_connection_replace_settings (connection, settings_dict, NULL);
+		g_variant_unref (settings_dict);
+	}
 
 	subject = validate_activation_request (self,
 	                                       context,
diff --git a/src/settings/nm-agent-manager.c b/src/settings/nm-agent-manager.c
index a2c0c6bb5f..6eb2fb30b1 100644
--- a/src/settings/nm-agent-manager.c
+++ b/src/settings/nm-agent-manager.c
@@ -40,6 +40,7 @@
 #include "nm-dbus-manager.h"
 #include "nm-session-monitor.h"
 #include "nm-simple-connection.h"
+#include "nm-utils-private.h"
 
 G_DEFINE_TYPE (NMAgentManager, nm_agent_manager, G_TYPE_OBJECT)
 
@@ -910,8 +911,13 @@ get_agent_request_secrets (ConnectionRequest *req, gboolean include_system_secre
 	tmp = nm_simple_connection_new_clone (req->connection);
 	nm_connection_clear_secrets (tmp);
 	if (include_system_secrets) {
-		if (req->existing_secrets)
-			(void) nm_connection_update_secrets (tmp, req->setting_name, req->existing_secrets, NULL);
+		if (req->existing_secrets) {
+			GVariant *secrets_dict;
+
+			secrets_dict = _nm_utils_connection_hash_to_dict (req->existing_secrets);
+			(void) nm_connection_update_secrets (tmp, req->setting_name, secrets_dict, NULL);
+			g_variant_unref (secrets_dict);
+		}
 	} else {
 		/* Update secret flags in the temporary connection to indicate that
 		 * the system secrets we're not sending to the agent aren't required,
@@ -1085,6 +1091,7 @@ get_start (gpointer user_data)
 		NMConnection *tmp;
 		GError *error = NULL;
 		gboolean new_secrets = (req->flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW);
+		GVariant *secrets_dict;
 
 		/* The connection already had secrets; check if any more are required.
 		 * If no more are required, we're done.  If secrets are still needed,
@@ -1094,7 +1101,8 @@ get_start (gpointer user_data)
 		tmp = nm_simple_connection_new_clone (req->connection);
 		g_assert (tmp);
 
-		if (!nm_connection_update_secrets (tmp, req->setting_name, req->existing_secrets, &error)) {
+		secrets_dict = _nm_utils_connection_hash_to_dict (req->existing_secrets);
+		if (!nm_connection_update_secrets (tmp, req->setting_name, secrets_dict, &error)) {
 			req_complete_error (parent, error);
 			g_clear_error (&error);
 		} else {
@@ -1114,6 +1122,7 @@ get_start (gpointer user_data)
 				request_next_agent (parent);
 			}
 		}
+		g_variant_unref (secrets_dict);
 		g_object_unref (tmp);
 	} else {
 		/* Couldn't get secrets from system settings, so now we ask the
diff --git a/src/settings/nm-secret-agent.c b/src/settings/nm-secret-agent.c
index 97728f804c..5507de5750 100644
--- a/src/settings/nm-secret-agent.c
+++ b/src/settings/nm-secret-agent.c
@@ -35,6 +35,7 @@
 #include "nm-logging.h"
 #include "nm-auth-subject.h"
 #include "nm-simple-connection.h"
+#include "nm-utils-private.h"
 
 G_DEFINE_TYPE (NMSecretAgent, nm_secret_agent, G_TYPE_OBJECT)
 
@@ -283,6 +284,7 @@ nm_secret_agent_get_secrets (NMSecretAgent *self,
                              gpointer callback_data)
 {
 	NMSecretAgentPrivate *priv;
+	GVariant *dict;
 	GHashTable *hash;
 	Request *r;
 
@@ -293,7 +295,9 @@ nm_secret_agent_get_secrets (NMSecretAgent *self,
 	priv = NM_SECRET_AGENT_GET_PRIVATE (self);
 	g_return_val_if_fail (priv->proxy != NULL, NULL);
 
-	hash = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	hash = _nm_utils_connection_dict_to_hash (dict);
+	g_variant_unref (dict);
 
 	/* Mask off the private ONLY_SYSTEM flag if present */
 	flags &= ~NM_SECRET_AGENT_GET_SECRETS_FLAG_ONLY_SYSTEM;
@@ -385,11 +389,14 @@ agent_new_save_delete (NMSecretAgent *self,
                        gpointer callback_data)
 {
 	NMSecretAgentPrivate *priv = NM_SECRET_AGENT_GET_PRIVATE (self);
+	GVariant *dict;
 	GHashTable *hash;
 	Request *r;
 	const char *cpath = nm_connection_get_path (connection);
 
-	hash = nm_connection_to_dbus (connection, flags);
+	dict = nm_connection_to_dbus (connection, flags);
+	hash = _nm_utils_connection_dict_to_hash (dict);
+	g_variant_unref (dict);
 
 	r = request_new (self, cpath, NULL, callback, callback_data);
 	r->call = dbus_g_proxy_begin_call_with_timeout (priv->proxy,
diff --git a/src/settings/nm-settings-connection.c b/src/settings/nm-settings-connection.c
index 513e6efc13..2f0bb8447b 100644
--- a/src/settings/nm-settings-connection.c
+++ b/src/settings/nm-settings-connection.c
@@ -440,7 +440,6 @@ nm_settings_connection_replace_settings (NMSettingsConnection *self,
                                          GError **error)
 {
 	NMSettingsConnectionPrivate *priv;
-	GHashTable *hash = NULL;
 	gboolean success = FALSE;
 
 	g_return_val_if_fail (NM_IS_SETTINGS_CONNECTION (self), FALSE);
@@ -476,10 +475,12 @@ nm_settings_connection_replace_settings (NMSettingsConnection *self,
 	 * in the replacement connection data if it was eg reread from disk.
 	 */
 	if (priv->agent_secrets) {
-		hash = nm_connection_to_dbus (priv->agent_secrets, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
-		if (hash) {
-			(void) nm_connection_update_secrets (NM_CONNECTION (self), NULL, hash, NULL);
-			g_hash_table_destroy (hash);
+		GVariant *dict;
+
+		dict = nm_connection_to_dbus (priv->agent_secrets, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
+		if (dict) {
+			(void) nm_connection_update_secrets (NM_CONNECTION (self), NULL, dict, NULL);
+			g_variant_unref (dict);
 		}
 	}
 
@@ -725,7 +726,7 @@ agent_secrets_done_cb (NMAgentManager *manager,
 	NMSettingsConnectionSecretsFunc callback = other_data2;
 	gpointer callback_data = other_data3;
 	GError *local = NULL;
-	GHashTable *hash;
+	GVariant *dict;
 	gboolean agent_had_system = FALSE;
 
 	if (error) {
@@ -808,14 +809,17 @@ agent_secrets_done_cb (NMAgentManager *manager,
 
 	/* Update the connection with our existing secrets from backing storage */
 	nm_connection_clear_secrets (NM_CONNECTION (self));
-	hash = nm_connection_to_dbus (priv->system_secrets, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
-	if (!hash || nm_connection_update_secrets (NM_CONNECTION (self), setting_name, hash, &local)) {
+	dict = nm_connection_to_dbus (priv->system_secrets, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
+	if (!dict || nm_connection_update_secrets (NM_CONNECTION (self), setting_name, dict, &local)) {
+		GVariant *secrets_dict;
+
 		/* Update the connection with the agent's secrets; by this point if any
 		 * system-owned secrets exist in 'secrets' the agent that provided them
 		 * will have been authenticated, so those secrets can replace the existing
 		 * system secrets.
 		 */
-		if (nm_connection_update_secrets (NM_CONNECTION (self), setting_name, secrets, &local)) {
+		secrets_dict = _nm_utils_connection_hash_to_dict (secrets);
+		if (nm_connection_update_secrets (NM_CONNECTION (self), setting_name, secrets_dict, &local)) {
 			/* Now that all secrets are updated, copy and cache new secrets, 
 			 * then save them to backing storage.
 			 */
@@ -848,6 +852,7 @@ agent_secrets_done_cb (NMAgentManager *manager,
 			            local ? local->code : -1,
 			            (local && local->message) ? local->message : "(unknown)");
 		}
+		g_variant_unref (secrets_dict);
 	} else {
 		nm_log_dbg (LOGD_SETTINGS, "(%s/%s:%u) failed to update with existing secrets: (%d) %s",
 		            nm_connection_get_uuid (NM_CONNECTION (self)),
@@ -859,8 +864,8 @@ agent_secrets_done_cb (NMAgentManager *manager,
 
 	callback (self, call_id, agent_username, setting_name, local, callback_data);
 	g_clear_error (&local);
-	if (hash)
-		g_hash_table_destroy (hash);
+	if (dict)
+		g_variant_unref (dict);
 }
 
 /**
@@ -890,7 +895,8 @@ nm_settings_connection_get_secrets (NMSettingsConnection *self,
                                     GError **error)
 {
 	NMSettingsConnectionPrivate *priv = NM_SETTINGS_CONNECTION_GET_PRIVATE (self);
-	GHashTable *existing_secrets;
+	GVariant *existing_secrets;
+	GHashTable *existing_secrets_hash;
 	guint32 call_id = 0;
 	char *joined_hints = NULL;
 
@@ -913,10 +919,11 @@ nm_settings_connection_get_secrets (NMSettingsConnection *self,
 	}
 
 	existing_secrets = nm_connection_to_dbus (priv->system_secrets, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
+	existing_secrets_hash = _nm_utils_connection_dict_to_hash (existing_secrets);
 	call_id = nm_agent_manager_get_secrets (priv->agent_mgr,
 	                                        NM_CONNECTION (self),
 	                                        subject,
-	                                        existing_secrets,
+	                                        existing_secrets_hash,
 	                                        setting_name,
 	                                        flags,
 	                                        hints,
@@ -924,8 +931,10 @@ nm_settings_connection_get_secrets (NMSettingsConnection *self,
 	                                        self,
 	                                        callback,
 	                                        callback_data);
+	if (existing_secrets_hash)
+		g_hash_table_unref (existing_secrets_hash);
 	if (existing_secrets)
-		g_hash_table_unref (existing_secrets);
+		g_variant_unref (existing_secrets);
 
 	if (nm_logging_enabled (LOGL_DEBUG, LOGD_SETTINGS)) {
 		if (hints)
@@ -1130,7 +1139,8 @@ get_settings_auth_cb (NMSettingsConnection *self,
 	if (error)
 		dbus_g_method_return_error (context, error);
 	else {
-		GHashTable *settings;
+		GVariant *settings;
+		GHashTable *settings_hash;
 		NMConnection *dupl_con;
 		NMSettingConnection *s_con;
 		NMSettingWireless *s_wifi;
@@ -1168,8 +1178,10 @@ get_settings_auth_cb (NMSettingsConnection *self,
 		 */
 		settings = nm_connection_to_dbus (NM_CONNECTION (dupl_con), NM_CONNECTION_SERIALIZE_NO_SECRETS);
 		g_assert (settings);
-		dbus_g_method_return (context, settings);
-		g_hash_table_destroy (settings);
+		settings_hash = _nm_utils_connection_dict_to_hash (settings);
+		dbus_g_method_return (context, settings_hash);
+		g_hash_table_destroy (settings_hash);
+		g_variant_unref (settings);
 		g_object_unref (dupl_con);
 	}
 }
@@ -1328,7 +1340,10 @@ impl_settings_connection_update_helper (NMSettingsConnection *self,
 
 	/* Check if the settings are valid first */
 	if (new_settings) {
-		tmp = nm_simple_connection_new_from_dbus (new_settings, &error);
+		GVariant *new_settings_dict = _nm_utils_connection_hash_to_dict (new_settings);
+
+		tmp = nm_simple_connection_new_from_dbus (new_settings_dict, &error);
+		g_variant_unref (new_settings_dict);
 		if (!tmp) {
 			g_assert (error);
 			goto error;
@@ -1483,6 +1498,7 @@ dbus_get_agent_secrets_cb (NMSettingsConnection *self,
 {
 	NMSettingsConnectionPrivate *priv = NM_SETTINGS_CONNECTION_GET_PRIVATE (self);
 	DBusGMethodInvocation *context = user_data;
+	GVariant *dict;
 	GHashTable *hash;
 
 	priv->reqs = g_slist_remove (priv->reqs, GUINT_TO_POINTER (call_id));
@@ -1495,11 +1511,15 @@ dbus_get_agent_secrets_cb (NMSettingsConnection *self,
 		 * secrets from backing storage and those returned from the agent
 		 * by the time we get here.
 		 */
-		hash = nm_connection_to_dbus (NM_CONNECTION (self), NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
-		if (!hash)
+		dict = nm_connection_to_dbus (NM_CONNECTION (self), NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
+		if (dict)
+			hash = _nm_utils_connection_dict_to_hash (dict);
+		else
 			hash = g_hash_table_new (NULL, NULL);
 		dbus_g_method_return (context, hash);
 		g_hash_table_destroy (hash);
+		if (dict)
+			g_variant_unref (dict);
 	}
 }
 
diff --git a/src/settings/nm-settings.c b/src/settings/nm-settings.c
index 0ad85e614f..cd163d2c2b 100644
--- a/src/settings/nm-settings.c
+++ b/src/settings/nm-settings.c
@@ -1221,9 +1221,12 @@ impl_settings_add_connection_helper (NMSettings *self,
                                      DBusGMethodInvocation *context)
 {
 	NMConnection *connection;
+	GVariant *dict;
 	GError *error = NULL;
 
-	connection = nm_simple_connection_new_from_dbus (settings, &error);
+	dict = _nm_utils_connection_hash_to_dict (settings);
+	connection = nm_simple_connection_new_from_dbus (dict, &error);
+	g_variant_unref (dict);
 	if (connection) {
 		nm_settings_add_connection_dbus (self,
 		                                 connection,
diff --git a/src/vpn-manager/nm-vpn-connection.c b/src/vpn-manager/nm-vpn-connection.c
index d11a1fe60a..b43fb2e222 100644
--- a/src/vpn-manager/nm-vpn-connection.c
+++ b/src/vpn-manager/nm-vpn-connection.c
@@ -40,6 +40,7 @@
 #include "nm-platform.h"
 #include "nm-logging.h"
 #include "nm-utils.h"
+#include "nm-utils-private.h"
 #include "nm-active-connection.h"
 #include "nm-dbus-glib-types.h"
 #include "NetworkManagerUtils.h"
@@ -1457,6 +1458,7 @@ _hash_with_username (NMConnection *connection, const char *username)
 	NMConnection *dup;
 	NMSettingVpn *s_vpn;
 	GHashTable *hash;
+	GVariant *dict;
 	const char *existing;
 
 	/* Shortcut if we weren't given a username or if there already was one in
@@ -1465,16 +1467,23 @@ _hash_with_username (NMConnection *connection, const char *username)
 	s_vpn = nm_connection_get_setting_vpn (connection);
 	g_assert (s_vpn);
 	existing = nm_setting_vpn_get_user_name (s_vpn);
-	if (username == NULL || existing)
-		return nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+	if (username == NULL || existing) {
+		dict = nm_connection_to_dbus (connection, NM_CONNECTION_SERIALIZE_ALL);
+		hash = _nm_utils_connection_dict_to_hash (dict);
+		g_variant_unref (dict);
+		return hash;
+	}
 
 	dup = nm_simple_connection_new_clone (connection);
 	g_assert (dup);
 	s_vpn = nm_connection_get_setting_vpn (dup);
 	g_assert (s_vpn);
 	g_object_set (s_vpn, NM_SETTING_VPN_USER_NAME, username, NULL);
-	hash = nm_connection_to_dbus (dup, NM_CONNECTION_SERIALIZE_ALL);
+	dict = nm_connection_to_dbus (dup, NM_CONNECTION_SERIALIZE_ALL);
 	g_object_unref (dup);
+
+	hash = _nm_utils_connection_dict_to_hash (dict);
+	g_variant_unref (dict);
 	return hash;
 }