diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 950ea70d1446..b7dc794eb0c7 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ipsec.c,v 1.165 2018/07/11 05:25:45 maxv Exp $ */
+/* $NetBSD: ipsec.c,v 1.166 2018/10/27 05:42:23 maxv Exp $ */
 /* $FreeBSD: ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $ */
 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
 
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.165 2018/07/11 05:25:45 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.166 2018/10/27 05:42:23 maxv Exp $");
 
 /*
  * IPsec controller part.
@@ -1868,18 +1868,6 @@ xform_init(struct secasvar *sav, int xftype)
 	return EINVAL;
 }
 
-void
-nat_t_ports_get(struct mbuf *m, u_int16_t *dport, u_int16_t *sport)
-{
-	struct m_tag *tag;
-
-	if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL))) {
-		*sport = ((u_int16_t *)(tag + 1))[0];
-		*dport = ((u_int16_t *)(tag + 1))[1];
-	} else
-		*sport = *dport = 0;
-}
-
 /*
  * XXXJRT This should be done as a protosw init call.
  */
diff --git a/sys/netipsec/ipsec.h b/sys/netipsec/ipsec.h
index d9cd4faa57e3..3e6ee4189ccb 100644
--- a/sys/netipsec/ipsec.h
+++ b/sys/netipsec/ipsec.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec.h,v 1.83 2018/09/14 05:09:51 maxv Exp $	*/
+/*	$NetBSD: ipsec.h,v 1.84 2018/10/27 05:42:23 maxv Exp $	*/
 /*	$FreeBSD: ipsec.h,v 1.2.4.2 2004/02/14 22:23:23 bms Exp $	*/
 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
 
@@ -302,8 +302,6 @@ struct mbuf *m_makespace(struct mbuf *, int, int, int *);
 void *m_pad(struct mbuf *, int);
 int m_striphdr(struct mbuf *, int, int);
 
-void nat_t_ports_get(struct mbuf *, u_int16_t *, u_int16_t *);
-
 extern int ipsec_used __read_mostly;
 extern int ipsec_enabled __read_mostly;
 
diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
index cf636fe9a13a..52abfa96332f 100644
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec_input.c,v 1.71 2018/09/14 05:09:51 maxv Exp $	*/
+/*	$NetBSD: ipsec_input.c,v 1.72 2018/10/27 05:42:23 maxv Exp $	*/
 /*	$FreeBSD: ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $	*/
 /*	$OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $	*/
 
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.71 2018/09/14 05:09:51 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.72 2018/10/27 05:42:23 maxv Exp $");
 
 /*
  * IPsec input processing.
@@ -170,6 +170,18 @@ ipsec4_fixup_checksum(struct mbuf *m)
 	return m;
 }
 
+static void
+nat_t_ports_get(struct mbuf *m, uint16_t *dport, uint16_t *sport)
+{
+	struct m_tag *tag;
+
+	if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL))) {
+		*sport = ((uint16_t *)(tag + 1))[0];
+		*dport = ((uint16_t *)(tag + 1))[1];
+	} else
+		*sport = *dport = 0;
+}
+
 /*
  * ipsec_common_input gets called when an IPsec-protected packet
  * is received by IPv4 or IPv6.  Its job is to find the right SA