While experimenting with the RekeyLimit option, I ran across a small bug in the convtime() function. When I entered a time value of '1m30s', I found that it converted this to 1860 seconds instead of the expected 90 seconds. Entering it as '30s1m' worked fine as a workaround (as would just entering "90"), but clearly the conversion is incorrect.

The bug appears to be that the convtime() function doesn't reset the multiplier back to 1 when it sees the 's'. So, whatever the previous multiplier was (60 in my example) is applied to the number before the 's'. This only works right when a seconds back is specified alone, or first.

Here's the code in question:

                switch (*endp++) {
                case '\0':
                        endp--;
                        break;
                case 's':
                case 'S':
                        break;
                case 'm':
                case 'M':
                        multiplier = MINUTES;
                        break;
                case 'h':
                case 'H':
                        multiplier = HOURS;
                        break;
                case 'd':
                case 'D':
                        multiplier = DAYS;
                        break;
                case 'w':
                case 'W':
                        multiplier = WEEKS;
                        break;
                default:
                        return -1;
                }

One option would be to have a "multiplier = 1" before the "break" for 's'/'S'. There's also a problem with '1m30', though. So, perhaps the better fix is to set the multiplier back to 1 inside the while loop, perhaps right before the switch.