ipsec: support header construction