ipsec: be careful of non existing mac headers