ike: Track unprocessed initial IKE messages like half-open IKE_SAs

This should make the DoS limits (cookie_threshold[_ip] and block_threshold)
more accurate so that it won't be possible to create lots of jobs from
spoofed IP addresses before half-open IKE_SAs are actually created from
these jobs to enforce those limits.

Note that retransmits are tracked as half-open SAs until they are
processed/dismissed as the check only happens in checkout_by_message().

Increasing the count in process_message_job_create() avoids issues with
missing calls to track_init() before calling checkout_by_message() (e.g.
when processing fragmented IKEv1 messages, which are reinjected via a
process message job).

src/libcharon/processing/jobs/process_message_job.c

@@ -133,5 +133,22 @@ process_message_job_t *process_message_job_create(message_t *message)
 		.message = message,
 	);
 
+	if (message->get_request(message) &&
+		message->get_exchange_type(message) == IKE_SA_INIT)
+	{
+		charon->ike_sa_manager->track_init(charon->ike_sa_manager,
+										   message->get_source(message));
+	}
+	if (message->get_exchange_type(message) == ID_PROT ||
+		message->get_exchange_type(message) == AGGRESSIVE)
+	{
+		ike_sa_id_t *id = message->get_ike_sa_id(message);
+
+		if (id->get_responder_spi(id) == 0)
+		{
+			charon->ike_sa_manager->track_init(charon->ike_sa_manager,
+											   message->get_source(message));
+		}
+	}
 	return &(this->public);
 }