More UnthrottleFirstTunnelOnly fixes

- Don't overwrite source data structure
  when enforcing UnthrottleFirstTunnelOnly

- Default isFirstTunnelInSession for pre-handshake
  so any unthrottle setting will apply during the
  initial protocol negotiation

psiphon/server/trafficRules.go

@@ -588,8 +588,8 @@ func (set *TrafficRulesSet) GetTrafficRules(
 	}
 
 	if *trafficRules.RateLimits.UnthrottleFirstTunnelOnly && !isFirstTunnelInSession {
-		*trafficRules.RateLimits.ReadUnthrottledBytes = 0
-		*trafficRules.RateLimits.WriteUnthrottledBytes = 0
+		trafficRules.RateLimits.ReadUnthrottledBytes = new(int64)
+		trafficRules.RateLimits.WriteUnthrottledBytes = new(int64)
 	}
 
 	log.WithContextFields(LogFields{"trafficRules": trafficRules}).Debug("selected traffic rules")

psiphon/server/tunnelServer.go

@@ -955,14 +955,19 @@ func newSshClient(
 
 	runCtx, stopRunning := context.WithCancel(context.Background())
 
+	// isFirstTunnelInSession is defaulted to true so that the pre-handshake
+	// traffic rules won't apply UnthrottleFirstTunnelOnly and negate any
+	// unthrottled bytes during the initial protocol negotiation.
+
 	client := &sshClient{
-		sshServer:         sshServer,
-		tunnelProtocol:    tunnelProtocol,
-		geoIPData:         geoIPData,
-		tcpPortForwardLRU: common.NewLRUConns(),
-		signalIssueSLOKs:  make(chan struct{}, 1),
-		runCtx:            runCtx,
-		stopRunning:       stopRunning,
+		sshServer:              sshServer,
+		tunnelProtocol:         tunnelProtocol,
+		geoIPData:              geoIPData,
+		isFirstTunnelInSession: true,
+		tcpPortForwardLRU:      common.NewLRUConns(),
+		signalIssueSLOKs:       make(chan struct{}, 1),
+		runCtx:                 runCtx,
+		stopRunning:            stopRunning,
 	}
 
 	client.tcpTrafficState.availablePortForwardCond = sync.NewCond(new(sync.Mutex))