diff -Naur libreswan-4.1-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.1/configs/d.ipsec.conf/ikev2.xml

--- libreswan-4.1-orig/configs/d.ipsec.conf/ikev2.xml	2020-10-18 21:11:05.000000000 -0400

+++ libreswan-4.1/configs/d.ipsec.conf/ikev2.xml	2020-10-27 23:31:41.943387992 -0400

@@ -1,15 +1,15 @@

   <varlistentry>

   <term><emphasis remap='B'>ikev2</emphasis></term>

   <listitem>

-<para>Whether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) settings to be used.

-Currently the accepted values are <emphasis remap='B'>no</emphasis>(the default),

-signifying only IKEv1 is accepted, or <emphasis remap='B'>yes</emphasis>,

+<para>Wether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) as the Internet Key Exchange (IKE) protcol.

+Currently the accepted values are <emphasis remap='B'>no</emphasis> (or <emphasis remap='B'>never</emphasis>)

+signifying only IKEv1 is accepted, or <emphasis remap='B'>insist</emphasis>(the default),

 signifying only IKEv2 is accepted. Previous versions allowed the keywords

-<emphasis remap='B'>propose</emphasis> or <emphasis remap='B'>permit</emphasis>

-that would allow either IKEv1 or IKEv2, but this is no longer supported. The

-permit option is interpreted as no and the propose option is interpreted as

-yes. Older versions also supported keyword

-<emphasis remap='B'>insist</emphasis> which is now interpreted as yes.

+<emphasis remap='B'>propose</emphasis>, <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>permit</emphasis>

+that would allow either IKEv1 or IKEv2, but this is no longer supported and both options

+now cause the connection to fail to load. <emphasis remap='B'>WARNING:</emphasis> This behaviour differs from upstream

+libreswan, which only accepts <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>no</emphasis> where yes means

+the same as insist.

 </para>

   </listitem>

   </varlistentry>

diff -Naur libreswan-4.1-orig/lib/libipsecconf/confread.c libreswan-4.1/lib/libipsecconf/confread.c

--- libreswan-4.1-orig/lib/libipsecconf/confread.c	2020-10-18 21:11:05.000000000 -0400

+++ libreswan-4.1/lib/libipsecconf/confread.c	2020-10-27 23:28:15.199171781 -0400

@@ -1299,13 +1299,16 @@

 		switch (conn->options[KNCF_IKEv2]) {

 		case fo_never:

-		case fo_permit:

 			conn->policy |= POLICY_IKEV1_ALLOW;

 			/* clear any inherited default */

 			conn->policy &= ~POLICY_IKEV2_ALLOW;

 			break;

-

+		case fo_permit:

+			starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never");

+			return TRUE;

 		case fo_propose:

+			starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never");

+			return TRUE;

 		case fo_insist:

 			conn->policy |= POLICY_IKEV2_ALLOW;

 			/* clear any inherited default */

diff -Naur libreswan-4.1-orig/programs/whack/whack.c libreswan-4.1/programs/whack/whack.c

--- libreswan-4.1-orig/programs/whack/whack.c	2020-10-18 21:11:05.000000000 -0400

+++ libreswan-4.1/programs/whack/whack.c	2020-10-27 23:33:01.065215832 -0400

@@ -780,7 +780,7 @@

 	PS("ikev1-allow", IKEV1_ALLOW), /* obsolete name */

 	PS("ikev2", IKEV2_ALLOW),

 	PS("ikev2-allow", IKEV2_ALLOW), /* obsolete name */

-	PS("ikev2-propose", IKEV2_ALLOW), /* obsolete, map onto allow */

+	/* not in RHEL8 PS("ikev2-propose", IKEV2_ALLOW), */

 	PS("allow-narrowing", IKEV2_ALLOW_NARROWING),

 #ifdef XAUTH_HAVE_PAM

@@ -1707,7 +1707,7 @@

 		/* --ikev1 */

 		case CDP_SINGLETON + POLICY_IKEV1_ALLOW_IX:

-		/* --ikev2 (now also --ikev2-propose) */

+		/* --ikev2 */

 		case CDP_SINGLETON + POLICY_IKEV2_ALLOW_IX:

 		/* --allow-narrowing */