ipsec: add support for chained buffers