User-Agent selection enhancements

 - Without an upstream proxy, only evaluate user agent choices for meek protocols
 - Use copy to ensure the dialHeaders values don't point at the original header's value slices

psiphon/common/userAgentPicker.go

@@ -30,7 +30,7 @@ func RegisterUserAgentPicker(generator func() string) {
 	registeredUserAgentPicker.Store(generator)
 }
 
-func PickUserAgent() string {
+func pickUserAgent() string {
 	generator := registeredUserAgentPicker.Load()
 	if generator != nil {
 		return generator.(func() string)()
@@ -49,12 +49,13 @@ func UserAgentIfUnset(h http.Header) (http.Header, bool) {
 
 		if h != nil {
 			for k, v := range h {
-				dialHeaders[k] = v
+				dialHeaders[k] = make([]string, len(v))
+				copy(dialHeaders[k], v)
 			}
 		}
 
 		if FlipCoin() {
-			dialHeaders.Set("User-Agent", PickUserAgent())
+			dialHeaders.Set("User-Agent", pickUserAgent())
 		} else {
 			dialHeaders.Set("User-Agent", "")
 		}

psiphon/tunnel.go

@@ -586,6 +586,8 @@ func dialSsh(
 	useObfuscatedSsh := false
 	var directTCPDialAddress string
 	var meekConfig *MeekConfig
+	var dialHeaders map[string][]string
+	var selectedUserAgent bool
 	var err error
 
 	switch selectedProtocol {
@@ -598,6 +600,8 @@ func dialSsh(
 
 	default:
 		useObfuscatedSsh = true
+		dialHeaders, selectedUserAgent = common.UserAgentIfUnset(config.UpstreamProxyCustomHeaders)
+
 		meekConfig, err = initMeekConfig(config, serverEntry, selectedProtocol, sessionId)
 		if err != nil {
 			return nil, common.ContextError(err)
@@ -623,8 +627,6 @@ func dialSsh(
 		resolvedIPAddress.Store(IPAddress)
 	}
 
-	dialHeaders, selectedUserAgent := common.UserAgentIfUnset(config.UpstreamProxyCustomHeaders)
-
 	// Create the base transport: meek or direct connection
 	dialConfig := &DialConfig{
 		UpstreamProxyUrl:              config.UpstreamProxyUrl,