fix(tuic): bound the timeout settings at a day

max_idle_time and authentication_timeout are second counts multiplied
into a Duration with no bound, so a stored value past the int64 range
wrapped negative and the QUIC listener panicked on the first
ClientHello, taking the panel down at every start until the row was
fixed. Saves now refuse more than a day, and a stored row past it fails
its own listener start instead.

internal/tuic/server.go

@@ -91,6 +91,11 @@ func NewServer(inst Instance, relay *SocksRelay) (*Server, error) {
 	if authTimeout <= 0 {
 		authTimeout = 3
 	}
+	// A second count past a day only wraps the Duration below; rows stored before the save
+	// path bounded it fail here instead of panicking the listener on its first handshake.
+	if maxIdle > MaxTimeoutSeconds || authTimeout > MaxTimeoutSeconds {
+		return nil, fmt.Errorf("tuic: max_idle_time and authentication_timeout must not exceed %d seconds", MaxTimeoutSeconds)
+	}
 	maxUdpSize := inst.MaxUdpRelayPacketSize
 	if maxUdpSize <= 0 {
 		maxUdpSize = 1500
@@ -636,6 +641,9 @@ type packetReassembler struct {
 	packets       map[packetFragmentKey]*packetReassembly
 }
 
+// MaxTimeoutSeconds bounds the second-count settings, far above any useful timeout.
+const MaxTimeoutSeconds = 86400
+
 const (
 	maxSafeUdpRelayPacketSize   = maxSocksUdpDatagramSize - 262
 	maxLegacyUdpRelayPacketSize = maxSocksUdpDatagramSize

internal/tuic/server_settings_test.go

@@ -127,3 +127,19 @@ func TestEnsureStartupFailureHonorsInboundLogThreshold(t *testing.T) {
 		})
 	}
 }
+
+// Seconds turn into a Duration by multiplication; a pushed value past the int64 range
+// wrapped negative and the QUIC listener panicked on the first ClientHello, every start.
+func TestNewServerRefusesTimeoutsPastADay(t *testing.T) {
+	cert, key := generateTestCert(t)
+	for name, inst := range map[string]Instance{
+		"max_idle_time":          {MaxIdleTime: 1 << 40},
+		"authentication_timeout": {AuthenticationTimeout: MaxTimeoutSeconds + 1},
+	} {
+		inst.Listen, inst.Certificate, inst.PrivateKey = "127.0.0.1", string(cert), string(key)
+		if s, err := NewServer(inst, &SocksRelay{Addr: "127.0.0.1:1"}); err == nil {
+			_ = s.Close()
+			t.Errorf("%s past a day was accepted", name)
+		}
+	}
+}