Use *_clear_free instead of *_free.

CVE-2014-4732
Constant time memory comparison.

CVE-2014-4731.

Non-constant time comparisons usually require millions of packets
in order to get enough statistics.  This is VERY hard to do with
WiFi or wired 802.1X.  The delays on switch port open / close
are on the order of seconds.
Check BN_rand_range return value

CVE-2014-4733.

In practice, the function should never fail.
Add minimal rlm_krb5 documentation file

Add doc/modules/rlm_krb5 - a minimal rlm_krb5 module documentation file,
based on the wiki page. Update raddb/mods-available/krb5 comments to
point to the actual and proper location.
Switch .cnf files to sha256 message digest

Use sha256 as default_md (message digest) in all .cnf files as it is
more secure than the previous, now considered weak, sha1.
Clarify conditions of limit hit SNMP notifications

Use "hit" instead of "reach" in the descriptions of serverMaxRequest and
serverMaxThreads SNMP notifications to make it clearer that they trigger
upon attempt to exceed the limit, not upon reaching the maximum allowed
value.
Add description of -P option to man pages

Add description of -P option to radtest and radclient man pages.
dhcpclient - timeout and decline, release, inform

Added receive timeout on socket according to -t option (retries are
still not handled).
Added commands for "decline", "release" and "inform" messages.
Updated usage.