Three patches versus master attached: The first puts a saner default config for radsec connections from clients, because in the dominant use-case for radsec clients (outside federation servers pointing to your IDP service) these connections are often nailed up by the client so if they timeout every thirty seconds (which is the new default as of the limit structure changes), the client just proceeds to rebuild them every 30 seconds. The second patch is a pasto that was preventing dhcp.c from compiling. Note I don't use this module, so I haven't tested that at all. The third patch decrements the client's connection limit counter when a socket times out so that a TCP connection falling down and restoring does not eventually run afoul of max_connections. Note this problem was pre-existing before for the new limit structure changes but also occured with them applied. This is only slightly tested, and might benefit from an experienced eyeball or two, especially WRT possibly backporting it.