Move entry-only fields from edge_connection_t to entry_connection_t

Also, refactor the code accordingly.

16 files changed, 541 insertions, 478 deletions

diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index f7d5524cd..39a50abaf 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -2648,14 +2648,19 @@ node_handles_some_port(const node_t *node, smartlist_t *needed_ports)
 static int
 ap_stream_wants_exit_attention(connection_t *conn)
 {
+  entry_connection_t *entry;
+  if (conn->type != CONN_TYPE_AP)
+    return 0;
+  entry = TO_ENTRY_CONN(conn);
+
   if (conn->type == CONN_TYPE_AP &&
       conn->state == AP_CONN_STATE_CIRCUIT_WAIT &&
       !conn->marked_for_close &&
-      !(TO_EDGE_CONN(conn)->want_onehop) && /* ignore one-hop streams */
-      !(TO_EDGE_CONN(conn)->use_begindir) && /* ignore targeted dir fetches */
-      !(TO_EDGE_CONN(conn)->chosen_exit_name) && /* ignore defined streams */
+      !(entry->want_onehop) && /* ignore one-hop streams */
+      !(entry->use_begindir) && /* ignore targeted dir fetches */
+      !(entry->chosen_exit_name) && /* ignore defined streams */
       !connection_edge_is_rendezvous_stream(TO_EDGE_CONN(conn)) &&
-      !circuit_stream_is_being_handled(TO_EDGE_CONN(conn), 0,
+      !circuit_stream_is_being_handled(TO_ENTRY_CONN(conn), 0,
                                        MIN_CIRCUITS_HANDLING_STREAM))
     return 1;
   return 0;
@@ -2760,7 +2765,7 @@ choose_good_exit_server_general(int need_uptime, int need_capacity)
     SMARTLIST_FOREACH_BEGIN(connections, connection_t *, conn) {
       if (!ap_stream_wants_exit_attention(conn))
         continue; /* Skip everything but APs in CIRCUIT_WAIT */
-      if (connection_ap_can_use_exit(TO_EDGE_CONN(conn), node)) {
+      if (connection_ap_can_use_exit(TO_ENTRY_CONN(conn), node)) {
         ++n_supported[i];
 //        log_fn(LOG_DEBUG,"%s is supported. n_supported[%d] now %d.",
 //               router->nickname, i, n_supported[i]);
diff --git a/src/or/circuituse.c b/src/or/circuituse.c
index 91f75733a..f7f080db1 100644
--- a/src/or/circuituse.c
+++ b/src/or/circuituse.c
@@ -41,7 +41,7 @@ static void circuit_increment_failure_count(void);
  */
 static int
 circuit_is_acceptable(const origin_circuit_t *origin_circ,
-                      const edge_connection_t *conn,
+                      const entry_connection_t *conn,
                       int must_be_open, uint8_t purpose,
                       int need_uptime, int need_internal,
                       time_t now)
@@ -135,10 +135,11 @@ circuit_is_acceptable(const origin_circuit_t *origin_circ,
       return 0;
     }
   } else { /* not general */
-    if ((conn->rend_data && !origin_circ->rend_data) ||
-        (!conn->rend_data && origin_circ->rend_data) ||
-        (conn->rend_data && origin_circ->rend_data &&
-         rend_cmp_service_ids(conn->rend_data->onion_address,
+    const edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(conn);
+    if ((edge_conn->rend_data && !origin_circ->rend_data) ||
+        (!edge_conn->rend_data && origin_circ->rend_data) ||
+        (edge_conn->rend_data && origin_circ->rend_data &&
+         rend_cmp_service_ids(edge_conn->rend_data->onion_address,
                               origin_circ->rend_data->onion_address))) {
       /* this circ is not for this conn */
       return 0;
@@ -159,11 +160,11 @@ circuit_is_acceptable(const origin_circuit_t *origin_circ,
  */
 static int
 circuit_is_better(const origin_circuit_t *oa, const origin_circuit_t *ob,
-                  const edge_connection_t *conn)
+                  const entry_connection_t *conn)
 {
   const circuit_t *a = TO_CIRCUIT(oa);
   const circuit_t *b = TO_CIRCUIT(ob);
-  const uint8_t purpose = conn->_base.purpose;
+  const uint8_t purpose = ENTRY_TO_CONN(conn)->purpose;
   int a_bits, b_bits;
 
   switch (purpose) {
@@ -241,7 +242,7 @@ circuit_is_better(const origin_circuit_t *oa, const origin_circuit_t *ob,
  * closest introduce-purposed circuit that you can find.
  */
 static origin_circuit_t *
-circuit_get_best(const edge_connection_t *conn,
+circuit_get_best(const entry_connection_t *conn,
                  int must_be_open, uint8_t purpose,
                  int need_uptime, int need_internal)
 {
@@ -544,7 +545,7 @@ circuit_remove_handled_ports(smartlist_t *needed_ports)
  * Else return 0.
  */
 int
-circuit_stream_is_being_handled(edge_connection_t *conn,
+circuit_stream_is_being_handled(entry_connection_t *conn,
                                 uint16_t port, int min)
 {
   circuit_t *circ;
@@ -738,8 +739,11 @@ circuit_detach_stream(circuit_t *circ, edge_connection_t *conn)
   tor_assert(circ);
   tor_assert(conn);
 
-  conn->cpath_layer = NULL; /* make sure we don't keep a stale pointer */
-  conn->may_use_optimistic_data = 0;
+  if (conn->_base.type == CONN_TYPE_AP) {
+    entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn);
+    entry_conn->may_use_optimistic_data = 0;
+  }
+  conn->cpath_layer = NULL; /* don't keep a stale pointer */
   conn->on_circuit = NULL;
 
   if (CIRCUIT_IS_ORIGIN(circ)) {
@@ -1286,7 +1290,7 @@ circuit_reset_failure_count(int timeout)
  * Write the found or in-progress or launched circ into *circp.
  */
 static int
-circuit_get_open_circ_or_launch(edge_connection_t *conn,
+circuit_get_open_circ_or_launch(entry_connection_t *conn,
                                 uint8_t desired_circuit_purpose,
                                 origin_circuit_t **circp)
 {
@@ -1298,11 +1302,11 @@ circuit_get_open_circ_or_launch(edge_connection_t *conn,
 
   tor_assert(conn);
   tor_assert(circp);
-  tor_assert(conn->_base.state == AP_CONN_STATE_CIRCUIT_WAIT);
+  tor_assert(ENTRY_TO_CONN(conn)->state == AP_CONN_STATE_CIRCUIT_WAIT);
   check_exit_policy =
       conn->socks_request->command == SOCKS_COMMAND_CONNECT &&
       !conn->use_begindir &&
-      !connection_edge_is_rendezvous_stream(conn);
+      !connection_edge_is_rendezvous_stream(ENTRY_TO_EDGE_CONN(conn));
   want_onehop = conn->want_onehop;
 
   need_uptime = !conn->want_onehop && !conn->use_begindir &&
@@ -1410,19 +1414,20 @@ circuit_get_open_circ_or_launch(edge_connection_t *conn,
 
     if (desired_circuit_purpose == CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT) {
       /* need to pick an intro point */
-      tor_assert(conn->rend_data);
-      extend_info = rend_client_get_random_intro(conn->rend_data);
+      rend_data_t *rend_data = ENTRY_TO_EDGE_CONN(conn)->rend_data;
+      tor_assert(rend_data);
+      extend_info = rend_client_get_random_intro(rend_data);
       if (!extend_info) {
         log_info(LD_REND,
                  "No intro points for '%s': re-fetching service descriptor.",
-                 safe_str_client(conn->rend_data->onion_address));
-        rend_client_refetch_v2_renddesc(conn->rend_data);
-        conn->_base.state = AP_CONN_STATE_RENDDESC_WAIT;
+                 safe_str_client(rend_data->onion_address));
+        rend_client_refetch_v2_renddesc(rend_data);
+        ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_RENDDESC_WAIT;
         return 0;
       }
       log_info(LD_REND,"Chose %s as intro point for '%s'.",
                extend_info_describe(extend_info),
-               safe_str_client(conn->rend_data->onion_address));
+               safe_str_client(rend_data->onion_address));
     }
 
     /* If we have specified a particular exit node for our
@@ -1511,7 +1516,7 @@ circuit_get_open_circ_or_launch(edge_connection_t *conn,
       rep_hist_note_used_internal(time(NULL), need_uptime, 1);
       if (circ) {
         /* write the service_id into circ */
-        circ->rend_data = rend_data_dup(conn->rend_data);
+        circ->rend_data = rend_data_dup(ENTRY_TO_EDGE_CONN(conn)->rend_data);
         if (circ->_base.purpose == CIRCUIT_PURPOSE_C_ESTABLISH_REND &&
             circ->_base.state == CIRCUIT_STATE_OPEN)
           rend_client_rendcirc_has_opened(circ);
@@ -1569,7 +1574,7 @@ optimistic_data_enabled(void)
  * hop in circ's cpath if <b>cpath</b> is NULL.
  */
 static void
-link_apconn_to_circ(edge_connection_t *apconn, origin_circuit_t *circ,
+link_apconn_to_circ(entry_connection_t *apconn, origin_circuit_t *circ,
                     crypt_path_t *cpath)
 {
   const node_t *exitnode;
@@ -1578,29 +1583,29 @@ link_apconn_to_circ(edge_connection_t *apconn, origin_circuit_t *circ,
   log_debug(LD_APP|LD_CIRC, "attaching new conn to circ. n_circ_id %d.",
             circ->_base.n_circ_id);
   /* reset it, so we can measure circ timeouts */
-  apconn->_base.timestamp_lastread = time(NULL);
-  apconn->next_stream = circ->p_streams;
-  apconn->on_circuit = TO_CIRCUIT(circ);
+  ENTRY_TO_CONN(apconn)->timestamp_lastread = time(NULL);
+  ENTRY_TO_EDGE_CONN(apconn)->next_stream = circ->p_streams;
+  ENTRY_TO_EDGE_CONN(apconn)->on_circuit = TO_CIRCUIT(circ);
   /* assert_connection_ok(conn, time(NULL)); */
-  circ->p_streams = apconn;
+  circ->p_streams = ENTRY_TO_EDGE_CONN(apconn);
 
   if (cpath) { /* we were given one; use it */
     tor_assert(cpath_is_on_circuit(circ, cpath));
-    apconn->cpath_layer = cpath;
-  } else { /* use the last hop in the circuit */
+  } else {
+    /* use the last hop in the circuit */
     tor_assert(circ->cpath);
     tor_assert(circ->cpath->prev);
     tor_assert(circ->cpath->prev->state == CPATH_STATE_OPEN);
-    apconn->cpath_layer = circ->cpath->prev;
+    cpath = circ->cpath->prev;
   }
+  ENTRY_TO_EDGE_CONN(apconn)->cpath_layer = cpath;
 
   circ->isolation_any_streams_attached = 1;
   connection_edge_update_circuit_isolation(apconn, circ, 0);
 
   /* See if we can use optimistic data on this circuit */
-  if (apconn->cpath_layer->extend_info &&
-      (exitnode = node_get_by_id(
-                     apconn->cpath_layer->extend_info->identity_digest)) &&
+  if (cpath->extend_info &&
+      (exitnode = node_get_by_id(cpath->extend_info->identity_digest)) &&
       exitnode->rs) {
     /* Okay; we know what exit node this is. */
     if (optimistic_data_enabled() &&
@@ -1642,7 +1647,7 @@ hostname_in_track_host_exits(const or_options_t *options, const char *address)
  * <b>conn</b>'s destination.
  */
 static void
-consider_recording_trackhost(const edge_connection_t *conn,
+consider_recording_trackhost(const entry_connection_t *conn,
                              const origin_circuit_t *circ)
 {
   const or_options_t *options = get_options();
@@ -1680,18 +1685,19 @@ consider_recording_trackhost(const edge_connection_t *conn,
  * indicated by <b>cpath</b>, or from the last hop in circ's cpath if
  * <b>cpath</b> is NULL. */
 int
-connection_ap_handshake_attach_chosen_circuit(edge_connection_t *conn,
+connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn,
                                               origin_circuit_t *circ,
                                               crypt_path_t *cpath)
 {
+  connection_t *base_conn = ENTRY_TO_CONN(conn);
   tor_assert(conn);
-  tor_assert(conn->_base.state == AP_CONN_STATE_CIRCUIT_WAIT ||
-             conn->_base.state == AP_CONN_STATE_CONTROLLER_WAIT);
+  tor_assert(base_conn->state == AP_CONN_STATE_CIRCUIT_WAIT ||
+             base_conn->state == AP_CONN_STATE_CONTROLLER_WAIT);
   tor_assert(conn->socks_request);
   tor_assert(circ);
   tor_assert(circ->_base.state == CIRCUIT_STATE_OPEN);
 
-  conn->_base.state = AP_CONN_STATE_CIRCUIT_WAIT;
+  base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
 
   if (!circ->_base.timestamp_dirty)
     circ->_base.timestamp_dirty = time(NULL);
@@ -1721,21 +1727,22 @@ connection_ap_handshake_attach_chosen_circuit(edge_connection_t *conn,
 /* XXXX this function should mark for close whenever it returns -1;
  * its callers shouldn't have to worry about that. */
 int
-connection_ap_handshake_attach_circuit(edge_connection_t *conn)
+connection_ap_handshake_attach_circuit(entry_connection_t *conn)
 {
+  connection_t *base_conn = ENTRY_TO_CONN(conn);
   int retval;
   int conn_age;
   int want_onehop;
 
   tor_assert(conn);
-  tor_assert(conn->_base.state == AP_CONN_STATE_CIRCUIT_WAIT);
+  tor_assert(base_conn->state == AP_CONN_STATE_CIRCUIT_WAIT);
   tor_assert(conn->socks_request);
   want_onehop = conn->want_onehop;
 
-  conn_age = (int)(time(NULL) - conn->_base.timestamp_created);
+  conn_age = (int)(time(NULL) - base_conn->timestamp_created);
 
   if (conn_age >= get_options()->SocksTimeout) {
-    int severity = (tor_addr_is_null(&conn->_base.addr) && !conn->_base.port) ?
+    int severity = (tor_addr_is_null(&base_conn->addr) && !base_conn->port) ?
       LOG_INFO : LOG_NOTICE;
     log_fn(severity, LD_APP,
            "Tried for %d seconds to get a connection to %s:%d. Giving up.",
@@ -1744,7 +1751,8 @@ connection_ap_handshake_attach_circuit(edge_connection_t *conn)
     return -1;
   }
 
-  if (!connection_edge_is_rendezvous_stream(conn)) { /* we're a general conn */
+  if (!connection_edge_is_rendezvous_stream(ENTRY_TO_EDGE_CONN(conn))) {
+    /* we're a general conn */
     origin_circuit_t *circ=NULL;
 
     if (conn->chosen_exit_name) {
@@ -1799,7 +1807,7 @@ connection_ap_handshake_attach_circuit(edge_connection_t *conn)
   } else { /* we're a rendezvous conn */
     origin_circuit_t *rendcirc=NULL, *introcirc=NULL;
 
-    tor_assert(!conn->cpath_layer);
+    tor_assert(!ENTRY_TO_EDGE_CONN(conn)->cpath_layer);
 
     /* start by finding a rendezvous circuit for us */
 
@@ -1855,8 +1863,9 @@ connection_ap_handshake_attach_circuit(edge_connection_t *conn)
             !c->marked_for_close && CIRCUIT_IS_ORIGIN(c)) {
           origin_circuit_t *oc = TO_ORIGIN_CIRCUIT(c);
           if (oc->rend_data &&
-              !rend_cmp_service_ids(conn->rend_data->onion_address,
-                                    oc->rend_data->onion_address)) {
+              !rend_cmp_service_ids(
+                            ENTRY_TO_EDGE_CONN(conn)->rend_data->onion_address,
+                            oc->rend_data->onion_address)) {
             log_info(LD_REND|LD_CIRC, "Closing introduction circuit that we "
                      "built in parallel.");
             circuit_mark_for_close(c, END_CIRC_REASON_TIMEOUT);
diff --git a/src/or/circuituse.h b/src/or/circuituse.h
index ab7f6a2fe..9867fd820 100644
--- a/src/or/circuituse.h
+++ b/src/or/circuituse.h
@@ -14,7 +14,7 @@
 
 void circuit_expire_building(void);
 void circuit_remove_handled_ports(smartlist_t *needed_ports);
-int circuit_stream_is_being_handled(edge_connection_t *conn, uint16_t port,
+int circuit_stream_is_being_handled(entry_connection_t *conn, uint16_t port,
                                     int min);
 #if 0
 int circuit_conforms_to_options(const origin_circuit_t *circ,
@@ -45,10 +45,10 @@ origin_circuit_t *circuit_launch_by_extend_info(uint8_t purpose,
                                                 int flags);
 origin_circuit_t *circuit_launch(uint8_t purpose, int flags);
 void circuit_reset_failure_count(int timeout);
-int connection_ap_handshake_attach_chosen_circuit(edge_connection_t *conn,
+int connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn,
                                                   origin_circuit_t *circ,
                                                   crypt_path_t *cpath);
-int connection_ap_handshake_attach_circuit(edge_connection_t *conn);
+int connection_ap_handshake_attach_circuit(entry_connection_t *conn);
 
 int hostname_in_track_host_exits(const or_options_t *options,
                                  const char *address);
diff --git a/src/or/connection.c b/src/or/connection.c
index a79962715..012a3fbd0 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -251,7 +251,7 @@ entry_connection_new(int type, int socket_family)
   entry_connection_t *entry_conn = tor_malloc_zero(sizeof(entry_connection_t));
   tor_assert(type == CONN_TYPE_AP);
   connection_init(time(NULL), ENTRY_TO_CONN(entry_conn), type, socket_family);
-  entry_conn->_edge.socks_request = socks_request_new();
+  entry_conn->socks_request = socks_request_new();
   return entry_conn;
 }
 
@@ -346,10 +346,10 @@ connection_init(time_t now, connection_t *conn, int type, int socket_family)
       conn->magic = OR_CONNECTION_MAGIC;
       break;
     case CONN_TYPE_EXIT:
-      conn->magic = ENTRY_CONNECTION_MAGIC;
+      conn->magic = EDGE_CONNECTION_MAGIC;
       break;
     case CONN_TYPE_AP:
-      conn->magic = EDGE_CONNECTION_MAGIC;
+      conn->magic = ENTRY_CONNECTION_MAGIC;
       break;
     case CONN_TYPE_DIR:
       conn->magic = DIR_CONNECTION_MAGIC;
@@ -483,19 +483,21 @@ _connection_free(connection_t *conn)
     smartlist_free(or_conn->active_circuit_pqueue);
     tor_free(or_conn->nickname);
   }
-  if (CONN_IS_EDGE(conn)) {
-    edge_connection_t *edge_conn = TO_EDGE_CONN(conn);
-    tor_free(edge_conn->chosen_exit_name);
-    tor_free(edge_conn->original_dest_address);
-    if (edge_conn->socks_request)
-      socks_request_free(edge_conn->socks_request);
-    if (edge_conn->pending_optimistic_data) {
-      generic_buffer_free(edge_conn->pending_optimistic_data);
+  if (conn->type == CONN_TYPE_AP) {
+    entry_connection_t *entry_conn = TO_ENTRY_CONN(conn);
+    tor_free(entry_conn->chosen_exit_name);
+    tor_free(entry_conn->original_dest_address);
+    if (entry_conn->socks_request)
+      socks_request_free(entry_conn->socks_request);
+    if (entry_conn->pending_optimistic_data) {
+      generic_buffer_free(entry_conn->pending_optimistic_data);
     }
-    if (edge_conn->sending_optimistic_data) {
-      generic_buffer_free(edge_conn->sending_optimistic_data);
+    if (entry_conn->sending_optimistic_data) {
+      generic_buffer_free(entry_conn->sending_optimistic_data);
     }
-    rend_data_free(edge_conn->rend_data);
+  }
+  if (CONN_IS_EDGE(conn)) {
+    rend_data_free(TO_EDGE_CONN(conn)->rend_data);
   }
   if (conn->type == CONN_TYPE_CONTROL) {
     control_connection_t *control_conn = TO_CONTROL_CONN(conn);
@@ -639,7 +641,7 @@ connection_about_to_close_connection(connection_t *conn)
       connection_or_about_to_close(TO_OR_CONN(conn));
       break;
     case CONN_TYPE_AP:
-      connection_ap_about_to_close(TO_EDGE_CONN(conn));
+      connection_ap_about_to_close(TO_ENTRY_CONN(conn));
       break;
     case CONN_TYPE_EXIT:
       connection_exit_about_to_close(TO_EDGE_CONN(conn));
@@ -1266,19 +1268,19 @@ connection_init_accepted_conn(connection_t *conn,
       control_event_or_conn_status(TO_OR_CONN(conn), OR_CONN_EVENT_NEW, 0);
       return connection_tls_start_handshake(TO_OR_CONN(conn), 1);
     case CONN_TYPE_AP:
-      TO_EDGE_CONN(conn)->isolation_flags = listener->isolation_flags;
-      TO_EDGE_CONN(conn)->session_group = listener->session_group;
-      TO_EDGE_CONN(conn)->nym_epoch = get_signewnym_epoch();
+      TO_ENTRY_CONN(conn)->isolation_flags = listener->isolation_flags;
+      TO_ENTRY_CONN(conn)->session_group = listener->session_group;
+      TO_ENTRY_CONN(conn)->nym_epoch = get_signewnym_epoch();
       switch (TO_CONN(listener)->type) {
         case CONN_TYPE_AP_LISTENER:
           conn->state = AP_CONN_STATE_SOCKS_WAIT;
           break;
         case CONN_TYPE_AP_TRANS_LISTENER:
-          TO_EDGE_CONN(conn)->is_transparent_ap = 1;
+          TO_ENTRY_CONN(conn)->is_transparent_ap = 1;
           conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
-          return connection_ap_process_transparent(TO_EDGE_CONN(conn));
+          return connection_ap_process_transparent(TO_ENTRY_CONN(conn));
         case CONN_TYPE_AP_NATD_LISTENER:
-          TO_EDGE_CONN(conn)->is_transparent_ap = 1;
+          TO_ENTRY_CONN(conn)->is_transparent_ap = 1;
           conn->state = AP_CONN_STATE_NATD_WAIT;
           break;
       }
@@ -2635,8 +2637,10 @@ connection_handle_read_impl(connection_t *conn)
     if (CONN_IS_EDGE(conn)) {
       edge_connection_t *edge_conn = TO_EDGE_CONN(conn);
       connection_edge_end_errno(edge_conn);
-      if (edge_conn->socks_request) /* broken, don't send a socks reply back */
-        edge_conn->socks_request->has_finished = 1;
+      if (conn->type == CONN_TYPE_AP && TO_ENTRY_CONN(conn)->socks_request) {
+        /* broken, don't send a socks reply back */
+        TO_ENTRY_CONN(conn)->socks_request->has_finished = 1;
+      }
     }
     connection_close_immediate(conn); /* Don't flush; connection is dead. */
     connection_mark_for_close(conn);
@@ -2978,8 +2982,10 @@ connection_handle_event_cb(struct bufferevent *bufev, short event, void *arg)
       edge_connection_t *edge_conn = TO_EDGE_CONN(conn);
       if (!edge_conn->edge_has_sent_end)
         connection_edge_end_errno(edge_conn);
-      if (edge_conn->socks_request) /* broken, don't send a socks reply back */
-        edge_conn->socks_request->has_finished = 1;
+      if (conn->type == CONN_TYPE_AP && TO_ENTRY_CONN(conn)->socks_request) {
+        /* broken, don't send a socks reply back */
+        TO_ENTRY_CONN(conn)->socks_request->has_finished = 1;
+      }
     }
     connection_close_immediate(conn); /* Connection is dead. */
     if (!conn->marked_for_close)
@@ -3509,8 +3515,7 @@ connection_get_by_type_state_rendquery(int type, int state,
              type == CONN_TYPE_AP || type == CONN_TYPE_EXIT);
   tor_assert(rendquery);
 
-  SMARTLIST_FOREACH(conns, connection_t *, conn,
-  {
+  SMARTLIST_FOREACH_BEGIN(conns, connection_t *, conn) {
     if (conn->type == type &&
         !conn->marked_for_close &&
         (!state || state == conn->state)) {
@@ -3525,7 +3530,7 @@ connection_get_by_type_state_rendquery(int type, int state,
                             TO_EDGE_CONN(conn)->rend_data->onion_address))
         return conn;
     }
-  });
+  } SMARTLIST_FOREACH_END(conn);
   return NULL;
 }
 
@@ -4016,21 +4021,18 @@ assert_connection_ok(connection_t *conn, time_t now)
   }
 
   if (CONN_IS_EDGE(conn)) {
-    edge_connection_t *edge_conn = TO_EDGE_CONN(conn);
-    if (edge_conn->chosen_exit_optional || edge_conn->chosen_exit_retries) {
-      tor_assert(conn->type == CONN_TYPE_AP);
-      tor_assert(edge_conn->chosen_exit_name);
-    }
-
     /* XXX unchecked: package window, deliver window. */
     if (conn->type == CONN_TYPE_AP) {
+      entry_connection_t *entry_conn = TO_ENTRY_CONN(conn);
+      if (entry_conn->chosen_exit_optional || entry_conn->chosen_exit_retries)
+        tor_assert(entry_conn->chosen_exit_name);
 
-      tor_assert(edge_conn->socks_request);
+      tor_assert(entry_conn->socks_request);
       if (conn->state == AP_CONN_STATE_OPEN) {
-        tor_assert(edge_conn->socks_request->has_finished);
+        tor_assert(entry_conn->socks_request->has_finished);
         if (!conn->marked_for_close) {
-          tor_assert(edge_conn->cpath_layer);
-          assert_cpath_layer_ok(edge_conn->cpath_layer);
+          tor_assert(ENTRY_TO_EDGE_CONN(entry_conn)->cpath_layer);
+          assert_cpath_layer_ok(ENTRY_TO_EDGE_CONN(entry_conn)->cpath_layer);
         }
       }
     }
@@ -4063,7 +4065,7 @@ assert_connection_ok(connection_t *conn, time_t now)
     case CONN_TYPE_AP:
       tor_assert(conn->state >= _AP_CONN_STATE_MIN);
       tor_assert(conn->state <= _AP_CONN_STATE_MAX);
-      tor_assert(TO_EDGE_CONN(conn)->socks_request);
+      tor_assert(TO_ENTRY_CONN(conn)->socks_request);
       break;
     case CONN_TYPE_DIR:
       tor_assert(conn->state >= _DIR_CONN_STATE_MIN);
diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c
index 5c0e43a65..df4acc46e 100644
--- a/src/or/connection_edge.c
+++ b/src/or/connection_edge.c
@@ -51,28 +51,29 @@
 #define SOCKS4_GRANTED          90
 #define SOCKS4_REJECT           91
 
-static int connection_ap_handshake_process_socks(edge_connection_t *conn);
-static int connection_ap_process_natd(edge_connection_t *conn);
+static int connection_ap_handshake_process_socks(entry_connection_t *conn);
+static int connection_ap_process_natd(entry_connection_t *conn);
 static int connection_exit_connect_dir(edge_connection_t *exitconn);
 static int address_is_in_virtual_range(const char *addr);
-static int consider_plaintext_ports(edge_connection_t *conn, uint16_t port);
+static int consider_plaintext_ports(entry_connection_t *conn, uint16_t port);
 static void clear_trackexithost_mappings(const char *exitname);
-static int connection_ap_supports_optimistic_data(const edge_connection_t *);
+static int connection_ap_supports_optimistic_data(const entry_connection_t *);
 
 /** An AP stream has failed/finished. If it hasn't already sent back
  * a socks reply, send one now (based on endreason). Also set
  * has_sent_end to 1, and mark the conn.
  */
 void
-_connection_mark_unattached_ap(edge_connection_t *conn, int endreason,
+_connection_mark_unattached_ap(entry_connection_t *conn, int endreason,
                                int line, const char *file)
 {
-  tor_assert(conn->_base.type == CONN_TYPE_AP);
-  conn->edge_has_sent_end = 1; /* no circ yet */
+  connection_t *base_conn = ENTRY_TO_CONN(conn);
+  tor_assert(base_conn->type == CONN_TYPE_AP);
+  ENTRY_TO_EDGE_CONN(conn)->edge_has_sent_end = 1; /* no circ yet */
 
-  if (conn->_base.marked_for_close) {
+  if (base_conn->marked_for_close) {
     /* This call will warn as appropriate. */
-    _connection_mark_for_close(TO_CONN(conn), line, file);
+    _connection_mark_for_close(base_conn, line, file);
     return;
   }
 
@@ -92,9 +93,9 @@ _connection_mark_unattached_ap(edge_connection_t *conn, int endreason,
       conn->socks_request->has_finished = 1;
   }
 
-  _connection_mark_and_flush(TO_CONN(conn), line, file);
+  _connection_mark_and_flush(base_conn, line, file);
 
-  conn->end_reason = endreason;
+  ENTRY_TO_EDGE_CONN(conn)->end_reason = endreason;
 }
 
 /** There was an EOF. Send an end and mark the connection for close.
@@ -112,8 +113,11 @@ connection_edge_reached_eof(edge_connection_t *conn)
     /* only mark it if not already marked. it's possible to
      * get the 'end' right around when the client hangs up on us. */
     connection_edge_end(conn, END_STREAM_REASON_DONE);
-    if (conn->socks_request) /* eof, so don't send a socks reply back */
-      conn->socks_request->has_finished = 1;
+    if (conn->_base.type == CONN_TYPE_AP) {
+      /* eof, so don't send a socks reply back */
+      if (EDGE_TO_ENTRY_CONN(conn)->socks_request)
+        EDGE_TO_ENTRY_CONN(conn)->socks_request->has_finished = 1;
+    }
     connection_mark_for_close(TO_CONN(conn));
   }
   return 0;
@@ -136,13 +140,13 @@ connection_edge_process_inbuf(edge_connection_t *conn, int package_partial)
 
   switch (conn->_base.state) {
     case AP_CONN_STATE_SOCKS_WAIT:
-      if (connection_ap_handshake_process_socks(conn) < 0) {
+      if (connection_ap_handshake_process_socks(EDGE_TO_ENTRY_CONN(conn)) < 0) {
         /* already marked */
         return -1;
       }
       return 0;
     case AP_CONN_STATE_NATD_WAIT:
-      if (connection_ap_process_natd(conn) < 0) {
+      if (connection_ap_process_natd(EDGE_TO_ENTRY_CONN(conn)) < 0) {
         /* already marked */
         return -1;
       }
@@ -156,7 +160,7 @@ connection_edge_process_inbuf(edge_connection_t *conn, int package_partial)
       }
       return 0;
     case AP_CONN_STATE_CONNECT_WAIT:
-      if (connection_ap_supports_optimistic_data(conn)) {
+      if (connection_ap_supports_optimistic_data(EDGE_TO_ENTRY_CONN(conn))) {
         log_info(LD_EDGE,
                  "data from edge while in '%s' state. Sending it anyway. "
                  "package_partial=%d, buflen=%ld",
@@ -198,9 +202,10 @@ connection_edge_destroy(circid_t circ_id, edge_connection_t *conn)
     log_info(LD_EDGE,
              "CircID %d: At an edge. Marking connection for close.", circ_id);
     if (conn->_base.type == CONN_TYPE_AP) {
-      connection_mark_unattached_ap(conn, END_STREAM_REASON_DESTROY);
+      entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn);
+      connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_DESTROY);
       control_event_stream_bandwidth(conn);
-      control_event_stream_status(conn, STREAM_EVENT_CLOSED,
+      control_event_stream_status(entry_conn, STREAM_EVENT_CLOSED,
                                   END_STREAM_REASON_DESTROY);
       conn->end_reason |= END_STREAM_REASON_FLAG_ALREADY_SENT_CLOSED;
     } else {
@@ -440,12 +445,13 @@ connection_edge_about_to_close(edge_connection_t *edge_conn)
 /* Called when we're about to finally unlink and free an AP (client)
  * connection: perform necessary accounting and cleanup */
 void
-connection_ap_about_to_close(edge_connection_t *edge_conn)
+connection_ap_about_to_close(entry_connection_t *entry_conn)
 {
   circuit_t *circ;
-  connection_t *conn = TO_CONN(edge_conn);
+  edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(entry_conn);
+  connection_t *conn = ENTRY_TO_CONN(entry_conn);
 
-  if (edge_conn->socks_request->has_finished == 0) {
+  if (entry_conn->socks_request->has_finished == 0) {
     /* since conn gets removed right after this function finishes,
      * there's no point trying to send back a reply at this point. */
     log_warn(LD_BUG,"Closing stream (marked at %s:%d) without sending"
@@ -457,14 +463,14 @@ connection_ap_about_to_close(edge_connection_t *edge_conn)
              " set end_reason.",
              conn->marked_for_close_file, conn->marked_for_close);
   }
-  if (edge_conn->dns_server_request) {
+  if (entry_conn->dns_server_request) {
     log_warn(LD_BUG,"Closing stream (marked at %s:%d) without having"
              " replied to DNS request.",
              conn->marked_for_close_file, conn->marked_for_close);
-    dnsserv_reject_request(edge_conn);
+    dnsserv_reject_request(entry_conn);
   }
   control_event_stream_bandwidth(edge_conn);
-  control_event_stream_status(edge_conn, STREAM_EVENT_CLOSED,
+  control_event_stream_status(entry_conn, STREAM_EVENT_CLOSED,
                               edge_conn->end_reason);
   circ = circuit_get_by_edge_conn(edge_conn);
   if (circ)
@@ -495,7 +501,7 @@ connection_exit_about_to_close(edge_connection_t *edge_conn)
  * two tries, and 15 seconds for each retry after
  * that. Hopefully this will improve the expected user experience. */
 static int
-compute_retry_timeout(edge_connection_t *conn)
+compute_retry_timeout(entry_connection_t *conn)
 {
   int timeout = get_options()->CircuitStreamTimeout;
   if (timeout) /* if our config options override the default, use them */
@@ -518,6 +524,7 @@ void
 connection_ap_expire_beginning(void)
 {
   edge_connection_t *conn;
+  entry_connection_t *entry_conn;
   circuit_t *circ;
   time_t now = time(NULL);
   const or_options_t *options = get_options();
@@ -526,33 +533,34 @@ connection_ap_expire_beginning(void)
   int seconds_idle, seconds_since_born;
   smartlist_t *conns = get_connection_array();
 
-  SMARTLIST_FOREACH_BEGIN(conns, connection_t *, c) {
-    if (c->type != CONN_TYPE_AP || c->marked_for_close)
+  SMARTLIST_FOREACH_BEGIN(conns, connection_t *, base_conn) {
+    if (base_conn->type != CONN_TYPE_AP || base_conn->marked_for_close)
       continue;
-    conn = TO_EDGE_CONN(c);
+    entry_conn = TO_ENTRY_CONN(base_conn);
+    conn = ENTRY_TO_EDGE_CONN(entry_conn);
     /* if it's an internal linked connection, don't yell its status. */
-    severity = (tor_addr_is_null(&conn->_base.addr) && !conn->_base.port)
+    severity = (tor_addr_is_null(&base_conn->addr) && !base_conn->port)
       ? LOG_INFO : LOG_NOTICE;
-    seconds_idle = (int)( now - conn->_base.timestamp_lastread );
-    seconds_since_born = (int)( now - conn->_base.timestamp_created );
+    seconds_idle = (int)( now - base_conn->timestamp_lastread );
+    seconds_since_born = (int)( now - base_conn->timestamp_created );
 
-    if (conn->_base.state == AP_CONN_STATE_OPEN)
+    if (base_conn->state == AP_CONN_STATE_OPEN)
       continue;
 
     /* We already consider SocksTimeout in
      * connection_ap_handshake_attach_circuit(), but we need to consider
      * it here too because controllers that put streams in controller_wait
      * state never ask Tor to attach the circuit. */
-    if (AP_CONN_STATE_IS_UNATTACHED(conn->_base.state)) {
+    if (AP_CONN_STATE_IS_UNATTACHED(base_conn->state)) {
       if (seconds_since_born >= options->SocksTimeout) {
         log_fn(severity, LD_APP,
             "Tried for %d seconds to get a connection to %s:%d. "
             "Giving up. (%s)",
             seconds_since_born,
-            safe_str_client(conn->socks_request->address),
-            conn->socks_request->port,
-            conn_state_to_string(CONN_TYPE_AP, conn->_base.state));
-        connection_mark_unattached_ap(conn, END_STREAM_REASON_TIMEOUT);
+            safe_str_client(entry_conn->socks_request->address),
+            entry_conn->socks_request->port,
+            conn_state_to_string(CONN_TYPE_AP, base_conn->state));
+        connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
       }
       continue;
     }
@@ -560,14 +568,14 @@ connection_ap_expire_beginning(void)
     /* We're in state connect_wait or resolve_wait now -- waiting for a
      * reply to our relay cell. See if we want to retry/give up. */
 
-    cutoff = compute_retry_timeout(conn);
+    cutoff = compute_retry_timeout(entry_conn);
     if (seconds_idle < cutoff)
       continue;
     circ = circuit_get_by_edge_conn(conn);
     if (!circ) { /* it's vanished? */
       log_info(LD_APP,"Conn is waiting (address %s), but lost its circ.",
-               safe_str_client(conn->socks_request->address));
-      connection_mark_unattached_ap(conn, END_STREAM_REASON_TIMEOUT);
+               safe_str_client(entry_conn->socks_request->address));
+      connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
       continue;
     }
     if (circ->purpose == CIRCUIT_PURPOSE_C_REND_JOINED) {
@@ -576,9 +584,9 @@ connection_ap_expire_beginning(void)
                "Rend stream is %d seconds late. Giving up on address"
                " '%s.onion'.",
                seconds_idle,
-               safe_str_client(conn->socks_request->address));
+               safe_str_client(entry_conn->socks_request->address));
         connection_edge_end(conn, END_STREAM_REASON_TIMEOUT);
-        connection_mark_unattached_ap(conn, END_STREAM_REASON_TIMEOUT);
+        connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
       }
       continue;
     }
@@ -587,9 +595,10 @@ connection_ap_expire_beginning(void)
            "We tried for %d seconds to connect to '%s' using exit %s."
            " Retrying on a new circuit.",
            seconds_idle,
-           safe_str_client(conn->socks_request->address),
+           safe_str_client(entry_conn->socks_request->address),
            conn->cpath_layer ?
-           extend_info_describe(conn->cpath_layer->extend_info): "*unnamed*");
+             extend_info_describe(conn->cpath_layer->extend_info):
+             "*unnamed*");
     /* send an end down the circuit */
     connection_edge_end(conn, END_STREAM_REASON_TIMEOUT);
     /* un-mark it as ending, since we're going to reuse it */
@@ -603,15 +612,15 @@ connection_ap_expire_beginning(void)
     circ->timestamp_dirty -= options->MaxCircuitDirtiness;
     /* give our stream another 'cutoff' seconds to try */
     conn->_base.timestamp_lastread += cutoff;
-    if (conn->num_socks_retries < 250) /* avoid overflow */
-      conn->num_socks_retries++;
+    if (entry_conn->num_socks_retries < 250) /* avoid overflow */
+      entry_conn->num_socks_retries++;
     /* move it back into 'pending' state, and try to attach. */
-    if (connection_ap_detach_retriable(conn, TO_ORIGIN_CIRCUIT(circ),
+    if (connection_ap_detach_retriable(entry_conn, TO_ORIGIN_CIRCUIT(circ),
                                        END_STREAM_REASON_TIMEOUT)<0) {
-      if (!conn->_base.marked_for_close)
-        connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
+      if (!base_conn->marked_for_close)
+        connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_CANT_ATTACH);
     }
-  } SMARTLIST_FOREACH_END(conn);
+  } SMARTLIST_FOREACH_END(base_conn);
 }
 
 /** Tell any AP streams that are waiting for a new circuit to try again,
@@ -620,7 +629,7 @@ connection_ap_expire_beginning(void)
 void
 connection_ap_attach_pending(void)
 {
-  edge_connection_t *edge_conn;
+  entry_connection_t *entry_conn;
   smartlist_t *conns = get_connection_array();
   SMARTLIST_FOREACH(conns, connection_t *, conn,
   {
@@ -628,10 +637,10 @@ connection_ap_attach_pending(void)
         conn->type != CONN_TYPE_AP ||
         conn->state != AP_CONN_STATE_CIRCUIT_WAIT)
       continue;
-    edge_conn = TO_EDGE_CONN(conn);
-    if (connection_ap_handshake_attach_circuit(edge_conn) < 0) {
-      if (!edge_conn->_base.marked_for_close)
-        connection_mark_unattached_ap(edge_conn,
+    entry_conn = TO_ENTRY_CONN(conn);
+    if (connection_ap_handshake_attach_circuit(entry_conn) < 0) {
+      if (!conn->marked_for_close)
+        connection_mark_unattached_ap(entry_conn,
                                       END_STREAM_REASON_CANT_ATTACH);
     }
   });
@@ -646,7 +655,7 @@ void
 connection_ap_fail_onehop(const char *failed_digest,
                           cpath_build_state_t *build_state)
 {
-  edge_connection_t *edge_conn;
+  entry_connection_t *entry_conn;
   char digest[DIGEST_LEN];
   smartlist_t *conns = get_connection_array();
   SMARTLIST_FOREACH_BEGIN(conns, connection_t *, conn) {
@@ -654,27 +663,27 @@ connection_ap_fail_onehop(const char *failed_digest,
         conn->type != CONN_TYPE_AP ||
         conn->state != AP_CONN_STATE_CIRCUIT_WAIT)
       continue;
-    edge_conn = TO_EDGE_CONN(conn);
-    if (!edge_conn->want_onehop)
+    entry_conn = TO_ENTRY_CONN(conn);
+    if (!entry_conn->want_onehop)
       continue;
-    if (hexdigest_to_digest(edge_conn->chosen_exit_name, digest) < 0 ||
+    if (hexdigest_to_digest(entry_conn->chosen_exit_name, digest) < 0 ||
         tor_memneq(digest, failed_digest, DIGEST_LEN))
       continue;
     if (tor_digest_is_zero(digest)) {
       /* we don't know the digest; have to compare addr:port */
       tor_addr_t addr;
       if (!build_state || !build_state->chosen_exit ||
-          !edge_conn->socks_request || !edge_conn->socks_request->address)
+          !entry_conn->socks_request || !entry_conn->socks_request->address)
         continue;
-      if (tor_addr_from_str(&addr, edge_conn->socks_request->address)<0 ||
+      if (tor_addr_from_str(&addr, entry_conn->socks_request->address)<0 ||
           !tor_addr_eq(&build_state->chosen_exit->addr, &addr) ||
-          build_state->chosen_exit->port != edge_conn->socks_request->port)
+          build_state->chosen_exit->port != entry_conn->socks_request->port)
         continue;
     }
     log_info(LD_APP, "Closing one-hop stream to '%s/%s' because the OR conn "
-                     "just failed.", edge_conn->chosen_exit_name,
-                     edge_conn->socks_request->address);
-    connection_mark_unattached_ap(edge_conn, END_STREAM_REASON_TIMEOUT);
+                     "just failed.", entry_conn->chosen_exit_name,
+                     entry_conn->socks_request->address);
+    connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
   } SMARTLIST_FOREACH_END(conn);
 }
 
@@ -685,7 +694,7 @@ connection_ap_fail_onehop(const char *failed_digest,
 void
 circuit_discard_optional_exit_enclaves(extend_info_t *info)
 {
-  edge_connection_t *edge_conn;
+  entry_connection_t *entry_conn;
   const node_t *r1, *r2;
 
   smartlist_t *conns = get_connection_array();
@@ -694,32 +703,32 @@ circuit_discard_optional_exit_enclaves(extend_info_t *info)
         conn->type != CONN_TYPE_AP ||
         conn->state != AP_CONN_STATE_CIRCUIT_WAIT)
       continue;
-    edge_conn = TO_EDGE_CONN(conn);
-    if (!edge_conn->chosen_exit_optional &&
-        !edge_conn->chosen_exit_retries)
+    entry_conn = TO_ENTRY_CONN(conn);
+    if (!entry_conn->chosen_exit_optional &&
+        !entry_conn->chosen_exit_retries)
       continue;
-    r1 = node_get_by_nickname(edge_conn->chosen_exit_name, 0);
+    r1 = node_get_by_nickname(entry_conn->chosen_exit_name, 0);
     r2 = node_get_by_id(info->identity_digest);
     if (!r1 || !r2 || r1 != r2)
       continue;
-    tor_assert(edge_conn->socks_request);
-    if (edge_conn->chosen_exit_optional) {
+    tor_assert(entry_conn->socks_request);
+    if (entry_conn->chosen_exit_optional) {
       log_info(LD_APP, "Giving up on enclave exit '%s' for destination %s.",
-               safe_str_client(edge_conn->chosen_exit_name),
-               escaped_safe_str_client(edge_conn->socks_request->address));
-      edge_conn->chosen_exit_optional = 0;
-      tor_free(edge_conn->chosen_exit_name); /* clears it */
+               safe_str_client(entry_conn->chosen_exit_name),
+               escaped_safe_str_client(entry_conn->socks_request->address));
+      entry_conn->chosen_exit_optional = 0;
+      tor_free(entry_conn->chosen_exit_name); /* clears it */
       /* if this port is dangerous, warn or reject it now that we don't
        * think it'll be using an enclave. */
-      consider_plaintext_ports(edge_conn, edge_conn->socks_request->port);
+      consider_plaintext_ports(entry_conn, entry_conn->socks_request->port);
     }
-    if (edge_conn->chosen_exit_retries) {
-      if (--edge_conn->chosen_exit_retries == 0) { /* give up! */
-        clear_trackexithost_mappings(edge_conn->chosen_exit_name);
-        tor_free(edge_conn->chosen_exit_name); /* clears it */
+    if (entry_conn->chosen_exit_retries) {
+      if (--entry_conn->chosen_exit_retries == 0) { /* give up! */
+        clear_trackexithost_mappings(entry_conn->chosen_exit_name);
+        tor_free(entry_conn->chosen_exit_name); /* clears it */
         /* if this port is dangerous, warn or reject it now that we don't
          * think it'll be using an enclave. */
-        consider_plaintext_ports(edge_conn, edge_conn->socks_request->port);
+        consider_plaintext_ports(entry_conn, entry_conn->socks_request->port);
       }
     }
   } SMARTLIST_FOREACH_END(conn);
@@ -733,11 +742,11 @@ circuit_discard_optional_exit_enclaves(extend_info_t *info)
  * Returns -1 on err, 1 on success, 0 on not-yet-sure.
  */
 int
-connection_ap_detach_retriable(edge_connection_t *conn, origin_circuit_t *circ,
+connection_ap_detach_retriable(entry_connection_t *conn, origin_circuit_t *circ,
                                int reason)
 {
   control_event_stream_status(conn, STREAM_EVENT_FAILED_RETRIABLE, reason);
-  conn->_base.timestamp_lastread = time(NULL);
+  ENTRY_TO_CONN(conn)->timestamp_lastread = time(NULL);
 
   if (conn->pending_optimistic_data) {
     generic_buffer_set_to_copy(&conn->sending_optimistic_data,
@@ -747,12 +756,12 @@ connection_ap_detach_retriable(edge_connection_t *conn, origin_circuit_t *circ,
   if (!get_options()->LeaveStreamsUnattached || conn->use_begindir) {
     /* If we're attaching streams ourself, or if this connection is
      * a tunneled directory connection, then just attach it. */
-    conn->_base.state = AP_CONN_STATE_CIRCUIT_WAIT;
-    circuit_detach_stream(TO_CIRCUIT(circ),conn);
+    ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CIRCUIT_WAIT;
+    circuit_detach_stream(TO_CIRCUIT(circ),ENTRY_TO_EDGE_CONN(conn));
     return connection_ap_handshake_attach_circuit(conn);
   } else {
-    conn->_base.state = AP_CONN_STATE_CONTROLLER_WAIT;
-    circuit_detach_stream(TO_CIRCUIT(circ),conn);
+    ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CONTROLLER_WAIT;
+    circuit_detach_stream(TO_CIRCUIT(circ),ENTRY_TO_EDGE_CONN(conn));
     return 0;
   }
 }
@@ -1605,7 +1614,7 @@ addressmap_get_mappings(smartlist_t *sl, time_t min_expires,
 /** Check if <b>conn</b> is using a dangerous port. Then warn and/or
  * reject depending on our config options. */
 static int
-consider_plaintext_ports(edge_connection_t *conn, uint16_t port)
+consider_plaintext_ports(entry_connection_t *conn, uint16_t port)
 {
   const or_options_t *options = get_options();
   int reject = smartlist_string_num_isin(options->RejectPlaintextPorts, port);
@@ -1640,14 +1649,14 @@ consider_plaintext_ports(edge_connection_t *conn, uint16_t port)
  *  documentation for arguments and return value.
  */
 int
-connection_ap_rewrite_and_attach_if_allowed(edge_connection_t *conn,
+connection_ap_rewrite_and_attach_if_allowed(entry_connection_t *conn,
                                             origin_circuit_t *circ,
                                             crypt_path_t *cpath)
 {
   const or_options_t *options = get_options();
 
   if (options->LeaveStreamsUnattached) {
-    conn->_base.state = AP_CONN_STATE_CONTROLLER_WAIT;
+    ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CONTROLLER_WAIT;
     return 0;
   }
   return connection_ap_handshake_rewrite_and_attach(conn, circ, cpath);
@@ -1669,7 +1678,7 @@ connection_ap_rewrite_and_attach_if_allowed(edge_connection_t *conn,
  * <b>cpath</b> is NULL.
  */
 int
-connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn,
+connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn,
                                            origin_circuit_t *circ,
                                            crypt_path_t *cpath)
 {
@@ -1686,6 +1695,7 @@ connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn,
      address, and we remap it to one because of an entry in the addressmap. */
   int remapped_to_exit = 0;
   time_t now = time(NULL);
+  connection_t *base_conn = ENTRY_TO_CONN(conn);
 
   tor_strlower(socks->address); /* normalize it */
   strlcpy(orig_address, socks->address, sizeof(orig_address));
@@ -1944,12 +1954,12 @@ connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn,
     } else {
       tor_fragile_assert();
     }
-    conn->_base.state = AP_CONN_STATE_CIRCUIT_WAIT;
+    base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
     if ((circ && connection_ap_handshake_attach_chosen_circuit(
                    conn, circ, cpath) < 0) ||
         (!circ &&
          connection_ap_handshake_attach_circuit(conn) < 0)) {
-      if (!conn->_base.marked_for_close)
+      if (!base_conn->marked_for_close)
         connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
       return -1;
     }
@@ -1959,6 +1969,7 @@ connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn,
     rend_cache_entry_t *entry;
     int r;
     rend_service_authorization_t *client_auth;
+    rend_data_t *rend_data;
     tor_assert(!automap);
     if (SOCKS_COMMAND_IS_RESOLVE(socks->command)) {
       /* if it's a resolve request, fail it right now, rather than
@@ -1980,16 +1991,17 @@ connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn,
       return -1;
     }
 
-    conn->rend_data = tor_malloc_zero(sizeof(rend_data_t));
-    strlcpy(conn->rend_data->onion_address, socks->address,
-            sizeof(conn->rend_data->onion_address));
+    ENTRY_TO_EDGE_CONN(conn)->rend_data = rend_data =
+      tor_malloc_zero(sizeof(rend_data_t));
+    strlcpy(rend_data->onion_address, socks->address,
+            sizeof(rend_data->onion_address));
     log_info(LD_REND,"Got a hidden service request for ID '%s'",
-             safe_str_client(conn->rend_data->onion_address));
+             safe_str_client(rend_data->onion_address));
     /* see if we already have it cached */
-    r = rend_cache_lookup_entry(conn->rend_data->onion_address, -1, &entry);
+    r = rend_cache_lookup_entry(rend_data->onion_address, -1, &entry);
     if (r<0) {
       log_warn(LD_BUG,"Invalid service name '%s'",
-               safe_str_client(conn->rend_data->onion_address));
+               safe_str_client(rend_data->onion_address));
       connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
       return -1;
     }
@@ -2000,24 +2012,24 @@ connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn,
 
     /* Look up if we have client authorization for it. */
     client_auth = rend_client_lookup_service_authorization(
-                                          conn->rend_data->onion_address);
+                                          rend_data->onion_address);
     if (client_auth) {
       log_info(LD_REND, "Using previously configured client authorization "
                         "for hidden service request.");
-      memcpy(conn->rend_data->descriptor_cookie,
+      memcpy(rend_data->descriptor_cookie,
              client_auth->descriptor_cookie, REND_DESC_COOKIE_LEN);
-      conn->rend_data->auth_type = client_auth->auth_type;
+      rend_data->auth_type = client_auth->auth_type;
     }
     if (r==0) {
-      conn->_base.state = AP_CONN_STATE_RENDDESC_WAIT;
+      base_conn->state = AP_CONN_STATE_RENDDESC_WAIT;
       log_info(LD_REND, "Unknown descriptor %s. Fetching.",
-               safe_str_client(conn->rend_data->onion_address));
-      rend_client_refetch_v2_renddesc(conn->rend_data);
+               safe_str_client(rend_data->onion_address));
+      rend_client_refetch_v2_renddesc(rend_data);
     } else { /* r > 0 */
-      conn->_base.state = AP_CONN_STATE_CIRCUIT_WAIT;
+      base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
       log_info(LD_REND, "Descriptor is here. Great.");
       if (connection_ap_handshake_attach_circuit(conn) < 0) {
-        if (!conn->_base.marked_for_close)
+        if (!base_conn->marked_for_close)
           connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
         return -1;
       }
@@ -2063,7 +2075,7 @@ get_pf_socket(void)
  * else return 0.
  */
 static int
-connection_ap_get_original_destination(edge_connection_t *conn,
+connection_ap_get_original_destination(entry_connection_t *conn,
                                        socks_request_t *req)
 {
 #ifdef TRANS_NETFILTER
@@ -2072,9 +2084,9 @@ connection_ap_get_original_destination(edge_connection_t *conn,
   socklen_t orig_dst_len = sizeof(orig_dst);
   tor_addr_t addr;
 
-  if (getsockopt(conn->_base.s, SOL_IP, SO_ORIGINAL_DST,
+  if (getsockopt(ENTRY_TO_CONN(conn)->s, SOL_IP, SO_ORIGINAL_DST,
                  (struct sockaddr*)&orig_dst, &orig_dst_len) < 0) {
-    int e = tor_socket_errno(conn->_base.s);
+    int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s);
     log_warn(LD_NET, "getsockopt() failed: %s", tor_socket_strerror(e));
     return -1;
   }
@@ -2091,9 +2103,9 @@ connection_ap_get_original_destination(edge_connection_t *conn,
   tor_addr_t addr;
   int pf = -1;
 
-  if (getsockname(conn->_base.s, (struct sockaddr*)&proxy_addr,
+  if (getsockname(ENTRY_TO_CONN(conn)->s, (struct sockaddr*)&proxy_addr,
                   &proxy_addr_len) < 0) {
-    int e = tor_socket_errno(conn->_base.s);
+    int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s);
     log_warn(LD_NET, "getsockname() to determine transocks destination "
              "failed: %s", tor_socket_strerror(e));
     return -1;
@@ -2105,16 +2117,16 @@ connection_ap_get_original_destination(edge_connection_t *conn,
   if (proxy_sa->sa_family == AF_INET) {
     struct sockaddr_in *sin = (struct sockaddr_in *)proxy_sa;
     pnl.af              = AF_INET;
-    pnl.saddr.v4.s_addr = tor_addr_to_ipv4n(&conn->_base.addr);
-    pnl.sport           = htons(conn->_base.port);
+    pnl.saddr.v4.s_addr = tor_addr_to_ipv4n(&ENTRY_TO_CONN(conn)->addr);
+    pnl.sport           = htons(ENTRY_TO_CONN(conn)->port);
     pnl.daddr.v4.s_addr = sin->sin_addr.s_addr;
     pnl.dport           = sin->sin_port;
   } else if (proxy_sa->sa_family == AF_INET6) {
     struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)proxy_sa;
     pnl.af = AF_INET6;
-    memcpy(&pnl.saddr.v6, tor_addr_to_in6(&conn->_base.addr),
+    memcpy(&pnl.saddr.v6, tor_addr_to_in6(&ENTRY_TO_CONN(conn)->addr),
            sizeof(struct in6_addr));
-    pnl.sport = htons(conn->_base.port);
+    pnl.sport = htons(ENTRY_TO_CONN(conn)->port);
     memcpy(&pnl.daddr.v6, &sin6->sin6_addr, sizeof(struct in6_addr));
     pnl.dport = sin6->sin6_port;
   } else {
@@ -2165,34 +2177,35 @@ connection_ap_get_original_destination(edge_connection_t *conn,
  * else return 0.
  */
 static int
-connection_ap_handshake_process_socks(edge_connection_t *conn)
+connection_ap_handshake_process_socks(entry_connection_t *conn)
 {
   socks_request_t *socks;
   int sockshere;
   const or_options_t *options = get_options();
   int had_reply = 0;
+  connection_t *base_conn = ENTRY_TO_CONN(conn);
 
   tor_assert(conn);
-  tor_assert(conn->_base.type == CONN_TYPE_AP);
-  tor_assert(conn->_base.state == AP_CONN_STATE_SOCKS_WAIT);
+  tor_assert(base_conn->type == CONN_TYPE_AP);
+  tor_assert(base_conn->state == AP_CONN_STATE_SOCKS_WAIT);
   tor_assert(conn->socks_request);
   socks = conn->socks_request;
 
   log_debug(LD_APP,"entered.");
 
-  IF_HAS_BUFFEREVENT(TO_CONN(conn), {
-    struct evbuffer *input = bufferevent_get_input(conn->_base.bufev);
+  IF_HAS_BUFFEREVENT(base_conn, {
+    struct evbuffer *input = bufferevent_get_input(base_conn->bufev);
     sockshere = fetch_from_evbuffer_socks(input, socks,
                                      options->TestSocks, options->SafeSocks);
   }) ELSE_IF_NO_BUFFEREVENT {
-    sockshere = fetch_from_buf_socks(conn->_base.inbuf, socks,
+    sockshere = fetch_from_buf_socks(base_conn->inbuf, socks,
                                      options->TestSocks, options->SafeSocks);
   };
 
   if (socks->replylen) {
     had_reply = 1;
     connection_write_to_buf((const char*)socks->reply, socks->replylen,
-                            TO_CONN(conn));
+                            base_conn);
     socks->replylen = 0;
   }
 
@@ -2227,12 +2240,11 @@ connection_ap_handshake_process_socks(edge_connection_t *conn)
  * for close), else return 0.
  */
 int
-connection_ap_process_transparent(edge_connection_t *conn)
+connection_ap_process_transparent(entry_connection_t *conn)
 {
   socks_request_t *socks;
 
   tor_assert(conn);
-  tor_assert(conn->_base.type == CONN_TYPE_AP);
   tor_assert(conn->socks_request);
   socks = conn->socks_request;
 
@@ -2268,7 +2280,7 @@ connection_ap_process_transparent(edge_connection_t *conn)
  * for close), else return 0.
  */
 static int
-connection_ap_process_natd(edge_connection_t *conn)
+connection_ap_process_natd(entry_connection_t *conn)
 {
   char tmp_buf[36], *tbuf, *daddr;
   size_t tlen = 30;
@@ -2276,8 +2288,7 @@ connection_ap_process_natd(edge_connection_t *conn)
   socks_request_t *socks;
 
   tor_assert(conn);
-  tor_assert(conn->_base.type == CONN_TYPE_AP);
-  tor_assert(conn->_base.state == AP_CONN_STATE_NATD_WAIT);
+  tor_assert(ENTRY_TO_CONN(conn)->state == AP_CONN_STATE_NATD_WAIT);
   tor_assert(conn->socks_request);
   socks = conn->socks_request;
 
@@ -2285,7 +2296,7 @@ connection_ap_process_natd(edge_connection_t *conn)
 
   /* look for LF-terminated "[DEST ip_addr port]"
    * where ip_addr is a dotted-quad and port is in string form */
-  err = connection_fetch_from_buf_line(TO_CONN(conn), tmp_buf, &tlen);
+  err = connection_fetch_from_buf_line(ENTRY_TO_CONN(conn), tmp_buf, &tlen);
   if (err == 0)
     return 0;
   if (err < 0) {
@@ -2329,7 +2340,7 @@ connection_ap_process_natd(edge_connection_t *conn)
 
   control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
 
-  conn->_base.state = AP_CONN_STATE_CIRCUIT_WAIT;
+  ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CIRCUIT_WAIT;
 
   return connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
 }
@@ -2362,14 +2373,14 @@ get_unique_stream_id_by_circ(origin_circuit_t *circ)
 /** Return true iff <b>conn</b> is linked to a circuit and configured to use
  * an exit that supports optimistic data. */
 static int
-connection_ap_supports_optimistic_data(const edge_connection_t *conn)
+connection_ap_supports_optimistic_data(const entry_connection_t *conn)
 {
-  tor_assert(conn->_base.type == CONN_TYPE_AP);
+  const edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(conn);
   /* We can only send optimistic data if we're connected to an open
      general circuit. */
-  if (conn->on_circuit == NULL ||
-      conn->on_circuit->state != CIRCUIT_STATE_OPEN ||
-      conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_GENERAL)
+  if (edge_conn->on_circuit == NULL ||
+      edge_conn->on_circuit->state != CIRCUIT_STATE_OPEN ||
+      edge_conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_GENERAL)
     return 0;
 
   return conn->may_use_optimistic_data;
@@ -2381,22 +2392,24 @@ connection_ap_supports_optimistic_data(const edge_connection_t *conn)
  * If ap_conn is broken, mark it for close and return -1. Else return 0.
  */
 int
-connection_ap_handshake_send_begin(edge_connection_t *ap_conn)
+connection_ap_handshake_send_begin(entry_connection_t *ap_conn)
 {
   char payload[CELL_PAYLOAD_SIZE];
   int payload_len;
   int begin_type;
   origin_circuit_t *circ;
-  tor_assert(ap_conn->on_circuit);
-  circ = TO_ORIGIN_CIRCUIT(ap_conn->on_circuit);
+  edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
+  connection_t *base_conn = TO_CONN(edge_conn);
+  tor_assert(edge_conn->on_circuit);
+  circ = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit);
 
-  tor_assert(ap_conn->_base.type == CONN_TYPE_AP);
-  tor_assert(ap_conn->_base.state == AP_CONN_STATE_CIRCUIT_WAIT);
+  tor_assert(base_conn->type == CONN_TYPE_AP);
+  tor_assert(base_conn->state == AP_CONN_STATE_CIRCUIT_WAIT);
   tor_assert(ap_conn->socks_request);
   tor_assert(SOCKS_COMMAND_IS_CONNECT(ap_conn->socks_request->command));
 
-  ap_conn->stream_id = get_unique_stream_id_by_circ(circ);
-  if (ap_conn->stream_id==0) {
+  edge_conn->stream_id = get_unique_stream_id_by_circ(circ);
+  if (edge_conn->stream_id==0) {
     /* XXXX023 Instead of closing this stream, we should make it get
      * retried on another circuit. */
     connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
@@ -2417,7 +2430,7 @@ connection_ap_handshake_send_begin(edge_connection_t *ap_conn)
   log_info(LD_APP,
            "Sending relay cell %d to begin stream %d.",
            (int)ap_conn->use_begindir,
-           ap_conn->stream_id);
+           edge_conn->stream_id);
 
   begin_type = ap_conn->use_begindir ?
                  RELAY_COMMAND_BEGIN_DIR : RELAY_COMMAND_BEGIN;
@@ -2425,28 +2438,28 @@ connection_ap_handshake_send_begin(edge_connection_t *ap_conn)
     tor_assert(circ->build_state->onehop_tunnel == 0);
   }
 
-  if (connection_edge_send_command(ap_conn, begin_type,
+  if (connection_edge_send_command(edge_conn, begin_type,
                   begin_type == RELAY_COMMAND_BEGIN ? payload : NULL,
                   begin_type == RELAY_COMMAND_BEGIN ? payload_len : 0) < 0)
     return -1; /* circuit is closed, don't continue */
 
-  ap_conn->package_window = STREAMWINDOW_START;
-  ap_conn->deliver_window = STREAMWINDOW_START;
-  ap_conn->_base.state = AP_CONN_STATE_CONNECT_WAIT;
+  edge_conn->package_window = STREAMWINDOW_START;
+  edge_conn->deliver_window = STREAMWINDOW_START;
+  base_conn->state = AP_CONN_STATE_CONNECT_WAIT;
   log_info(LD_APP,"Address/port sent, ap socket %d, n_circ_id %d",
-           ap_conn->_base.s, circ->_base.n_circ_id);
+           base_conn->s, circ->_base.n_circ_id);
   control_event_stream_status(ap_conn, STREAM_EVENT_SENT_CONNECT, 0);
 
   /* If there's queued-up data, send it now */
-  if ((connection_get_inbuf_len(TO_CONN(ap_conn)) ||
+  if ((connection_get_inbuf_len(base_conn) ||
        ap_conn->sending_optimistic_data) &&
       connection_ap_supports_optimistic_data(ap_conn)) {
     log_info(LD_APP, "Sending up to %ld + %ld bytes of queued-up data",
-             connection_get_inbuf_len(TO_CONN(ap_conn)),
+             connection_get_inbuf_len(base_conn),
 	     ap_conn->sending_optimistic_data ?
 		generic_buffer_len(ap_conn->sending_optimistic_data) : 0);
-    if (connection_edge_package_raw_inbuf(ap_conn, 1, NULL) < 0) {
-      connection_mark_for_close(TO_CONN(ap_conn));
+    if (connection_edge_package_raw_inbuf(edge_conn, 1, NULL) < 0) {
+      connection_mark_for_close(base_conn);
     }
   }
 
@@ -2459,25 +2472,27 @@ connection_ap_handshake_send_begin(edge_connection_t *ap_conn)
  * If ap_conn is broken, mark it for close and return -1. Else return 0.
  */
 int
-connection_ap_handshake_send_resolve(edge_connection_t *ap_conn)
+connection_ap_handshake_send_resolve(entry_connection_t *ap_conn)
 {
   int payload_len, command;
   const char *string_addr;
   char inaddr_buf[REVERSE_LOOKUP_NAME_BUF_LEN];
   origin_circuit_t *circ;
-  tor_assert(ap_conn->on_circuit);
-  circ = TO_ORIGIN_CIRCUIT(ap_conn->on_circuit);
+  edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
+  connection_t *base_conn = TO_CONN(edge_conn);
+  tor_assert(edge_conn->on_circuit);
+  circ = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit);
 
-  tor_assert(ap_conn->_base.type == CONN_TYPE_AP);
-  tor_assert(ap_conn->_base.state == AP_CONN_STATE_CIRCUIT_WAIT);
+  tor_assert(base_conn->type == CONN_TYPE_AP);
+  tor_assert(base_conn->state == AP_CONN_STATE_CIRCUIT_WAIT);
   tor_assert(ap_conn->socks_request);
   tor_assert(circ->_base.purpose == CIRCUIT_PURPOSE_C_GENERAL);
 
   command = ap_conn->socks_request->command;
   tor_assert(SOCKS_COMMAND_IS_RESOLVE(command));
 
-  ap_conn->stream_id = get_unique_stream_id_by_circ(circ);
-  if (ap_conn->stream_id==0) {
+  edge_conn->stream_id = get_unique_stream_id_by_circ(circ);
+  if (edge_conn->stream_id==0) {
     /* XXXX023 Instead of closing this stream, we should make it get
      * retried on another circuit. */
     connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
@@ -2522,18 +2537,18 @@ connection_ap_handshake_send_resolve(edge_connection_t *ap_conn)
   }
 
   log_debug(LD_APP,
-            "Sending relay cell to begin stream %d.", ap_conn->stream_id);
+            "Sending relay cell to begin stream %d.", edge_conn->stream_id);
 
-  if (connection_edge_send_command(ap_conn,
+  if (connection_edge_send_command(edge_conn,
                            RELAY_COMMAND_RESOLVE,
                            string_addr, payload_len) < 0)
     return -1; /* circuit is closed, don't continue */
 
-  tor_free(ap_conn->_base.address); /* Maybe already set by dnsserv. */
-  ap_conn->_base.address = tor_strdup("(Tor_internal)");
-  ap_conn->_base.state = AP_CONN_STATE_RESOLVE_WAIT;
+  tor_free(base_conn->address); /* Maybe already set by dnsserv. */
+  base_conn->address = tor_strdup("(Tor_internal)");
+  base_conn->state = AP_CONN_STATE_RESOLVE_WAIT;
   log_info(LD_APP,"Address sent for resolve, ap socket %d, n_circ_id %d",
-           ap_conn->_base.s, circ->_base.n_circ_id);
+           base_conn->s, circ->_base.n_circ_id);
   control_event_stream_status(ap_conn, STREAM_EVENT_NEW, 0);
   control_event_stream_status(ap_conn, STREAM_EVENT_SENT_RESOLVE, 0);
   return 0;
@@ -2546,23 +2561,23 @@ connection_ap_handshake_send_resolve(edge_connection_t *ap_conn)
  * Return the other end of the linked connection pair, or -1 if error.
  * DOCDOC partner.
  */
-edge_connection_t *
+entry_connection_t *
 connection_ap_make_link(connection_t *partner,
                         char *address, uint16_t port,
                         const char *digest,
                         int session_group, int isolation_flags,
                         int use_begindir, int want_onehop)
 {
-  entry_connection_t *entry_conn;
-  edge_connection_t *conn;
+  entry_connection_t *conn;
+  connection_t *base_conn;
 
   log_info(LD_APP,"Making internal %s tunnel to %s:%d ...",
            want_onehop ? "direct" : "anonymized",
            safe_str_client(address), port);
 
-  entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
-  conn = ENTRY_TO_EDGE_CONN(entry_conn);
-  conn->_base.linked = 1; /* so that we can add it safely below. */
+  conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
+  base_conn = ENTRY_TO_CONN(conn);
+  base_conn->linked = 1; /* so that we can add it safely below. */
 
   /* populate conn->socks_request */
 
@@ -2588,24 +2603,24 @@ connection_ap_make_link(connection_t *partner,
   conn->session_group = session_group;
   conn->isolation_flags = isolation_flags;
 
-  conn->_base.address = tor_strdup("(Tor_internal)");
-  tor_addr_make_unspec(&conn->_base.addr);
-  conn->_base.port = 0;
+  base_conn->address = tor_strdup("(Tor_internal)");
+  tor_addr_make_unspec(&base_conn->addr);
+  base_conn->port = 0;
 
-  connection_link_connections(partner, TO_CONN(conn));
+  connection_link_connections(partner, base_conn);
 
-  if (connection_add(TO_CONN(conn)) < 0) { /* no space, forget it */
-    connection_free(TO_CONN(conn));
+  if (connection_add(base_conn) < 0) { /* no space, forget it */
+    connection_free(base_conn);
     return NULL;
   }
 
-  conn->_base.state = AP_CONN_STATE_CIRCUIT_WAIT;
+  base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
 
   control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
 
   /* attaching to a dirty circuit is fine */
   if (connection_ap_handshake_attach_circuit(conn) < 0) {
-    if (!conn->_base.marked_for_close)
+    if (!base_conn->marked_for_close)
       connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
     return NULL;
   }
@@ -2618,7 +2633,7 @@ connection_ap_make_link(connection_t *partner,
  * or resolve error.  Takes the same arguments as does
  * connection_ap_handshake_socks_resolved(). */
 static void
-tell_controller_about_resolved_result(edge_connection_t *conn,
+tell_controller_about_resolved_result(entry_connection_t *conn,
                                       int answer_type,
                                       size_t answer_len,
                                       const char *answer,
@@ -2657,7 +2672,7 @@ tell_controller_about_resolved_result(edge_connection_t *conn,
 /* XXXX023 the use of the ttl and expires fields is nutty.  Let's make this
  * interface and those that use it less ugly. */
 void
-connection_ap_handshake_socks_resolved(edge_connection_t *conn,
+connection_ap_handshake_socks_resolved(entry_connection_t *conn,
                                        int answer_type,
                                        size_t answer_len,
                                        const uint8_t *answer,
@@ -2682,7 +2697,7 @@ connection_ap_handshake_socks_resolved(edge_connection_t *conn,
     }
   }
 
-  if (conn->is_dns_request) {
+  if (ENTRY_TO_EDGE_CONN(conn)->is_dns_request) {
     if (conn->dns_server_request) {
       /* We had a request on our DNS port: answer it. */
       dnsserv_resolved(conn, answer_type, answer_len, (char*)answer, ttl);
@@ -2762,7 +2777,7 @@ connection_ap_handshake_socks_resolved(edge_connection_t *conn,
  * be 0 or REASON_DONE.  Send endreason to the controller, if appropriate.
  */
 void
-connection_ap_handshake_socks_reply(edge_connection_t *conn, char *reply,
+connection_ap_handshake_socks_reply(entry_connection_t *conn, char *reply,
                                     size_t replylen, int endreason)
 {
   char buf[256];
@@ -2781,7 +2796,7 @@ connection_ap_handshake_socks_reply(edge_connection_t *conn, char *reply,
     return;
   }
   if (replylen) { /* we already have a reply in mind */
-    connection_write_to_buf(reply, replylen, TO_CONN(conn));
+    connection_write_to_buf(reply, replylen, ENTRY_TO_CONN(conn));
     conn->socks_request->has_finished = 1;
     return;
   }
@@ -2789,7 +2804,7 @@ connection_ap_handshake_socks_reply(edge_connection_t *conn, char *reply,
     memset(buf,0,SOCKS4_NETWORK_LEN);
     buf[1] = (status==SOCKS5_SUCCEEDED ? SOCKS4_GRANTED : SOCKS4_REJECT);
     /* leave version, destport, destip zero */
-    connection_write_to_buf(buf, SOCKS4_NETWORK_LEN, TO_CONN(conn));
+    connection_write_to_buf(buf, SOCKS4_NETWORK_LEN, ENTRY_TO_CONN(conn));
   } else if (conn->socks_request->socks_version == 5) {
     buf[0] = 5; /* version 5 */
     buf[1] = (char)status;
@@ -2797,7 +2812,7 @@ connection_ap_handshake_socks_reply(edge_connection_t *conn, char *reply,
     buf[3] = 1; /* ipv4 addr */
     memset(buf+4,0,6); /* Set external addr/port to 0.
                           The spec doesn't seem to say what to do here. -RD */
-    connection_write_to_buf(buf,10,TO_CONN(conn));
+    connection_write_to_buf(buf,10,ENTRY_TO_CONN(conn));
   }
   /* If socks_version isn't 4 or 5, don't send anything.
    * This can happen in the case of AP bridges. */
@@ -3230,12 +3245,11 @@ connection_edge_is_rendezvous_stream(edge_connection_t *conn)
  * resolved.)
  */
 int
-connection_ap_can_use_exit(const edge_connection_t *conn, const node_t *exit)
+connection_ap_can_use_exit(const entry_connection_t *conn, const node_t *exit)
 {
   const or_options_t *options = get_options();
 
   tor_assert(conn);
-  tor_assert(conn->_base.type == CONN_TYPE_AP);
   tor_assert(conn->socks_request);
   tor_assert(exit);
 
@@ -3333,21 +3347,21 @@ parse_extended_hostname(char *address, int allowdotexit)
 /** Return true iff <b>a</b> and <b>b</b> have isolation rules and fields that
  * make it permissible to put them on the same circuit.*/
 int
-connection_edge_streams_are_compatible(const edge_connection_t *a,
-                                       const edge_connection_t *b)
+connection_edge_streams_are_compatible(const entry_connection_t *a,
+                                       const entry_connection_t *b)
 {
   const uint8_t iso = a->isolation_flags | b->isolation_flags;
 
   if (! a->original_dest_address) {
     log_warn(LD_BUG, "Reached connection_edge_streams_are_compatible without "
              "having set a->original_dest_address");
-    ((edge_connection_t*)a)->original_dest_address =
+    ((entry_connection_t*)a)->original_dest_address =
       tor_strdup(a->socks_request->address);
   }
   if (! b->original_dest_address) {
     log_warn(LD_BUG, "Reached connection_edge_streams_are_compatible without "
              "having set b->original_dest_address");
-    ((edge_connection_t*)b)->original_dest_address =
+    ((entry_connection_t*)b)->original_dest_address =
       tor_strdup(a->socks_request->address);
   }
 
@@ -3364,11 +3378,11 @@ connection_edge_streams_are_compatible(const edge_connection_t *a,
        strcmp_opt(a->socks_request->password, b->socks_request->password)))
     return 0;
   if ((iso & ISO_CLIENTPROTO) &&
-      (TO_CONN(a)->type != TO_CONN(b)->type ||
+      (ENTRY_TO_CONN(a)->type != ENTRY_TO_CONN(b)->type ||
        a->socks_request->socks_version != b->socks_request->socks_version))
     return 0;
   if ((iso & ISO_CLIENTADDR) &&
-      !tor_addr_eq(&TO_CONN(a)->addr, &TO_CONN(b)->addr))
+      !tor_addr_eq(&ENTRY_TO_CONN(a)->addr, &ENTRY_TO_CONN(b)->addr))
     return 0;
   if ((iso & ISO_SESSIONGRP) && a->session_group != b->session_group)
     return 0;
@@ -3383,7 +3397,7 @@ connection_edge_streams_are_compatible(const edge_connection_t *a,
  * should prevent it from being attached to <b>circ</b>.
  */
 int
-connection_edge_compatible_with_circuit(const edge_connection_t *conn,
+connection_edge_compatible_with_circuit(const entry_connection_t *conn,
                                         const origin_circuit_t *circ)
 {
   const uint8_t iso = conn->isolation_flags;
@@ -3407,7 +3421,7 @@ connection_edge_compatible_with_circuit(const edge_connection_t *conn,
   if (! conn->original_dest_address) {
     log_warn(LD_BUG, "Reached connection_edge_compatible_with_circuit without "
              "having set conn->original_dest_address");
-    ((edge_connection_t*)conn)->original_dest_address =
+    ((entry_connection_t*)conn)->original_dest_address =
       tor_strdup(conn->socks_request->address);
   }
 
@@ -3426,11 +3440,11 @@ connection_edge_compatible_with_circuit(const edge_connection_t *conn,
        strcmp_opt(conn->socks_request->password, circ->socks_password)))
     return 0;
   if ((iso & ISO_CLIENTPROTO) &&
-      (TO_CONN(conn)->type != circ->client_proto_type ||
+      (ENTRY_TO_CONN(conn)->type != circ->client_proto_type ||
        conn->socks_request->socks_version != circ->client_proto_socksver))
     return 0;
   if ((iso & ISO_CLIENTADDR) &&
-      !tor_addr_eq(&TO_CONN(conn)->addr, &circ->client_addr))
+      !tor_addr_eq(&ENTRY_TO_CONN(conn)->addr, &circ->client_addr))
     return 0;
   if ((iso & ISO_SESSIONGRP) && conn->session_group != circ->session_group)
     return 0;
@@ -3449,14 +3463,14 @@ connection_edge_compatible_with_circuit(const edge_connection_t *conn,
  * <b>circ</b> has had no streams attached to it.
  */
 int
-connection_edge_update_circuit_isolation(const edge_connection_t *conn,
+connection_edge_update_circuit_isolation(const entry_connection_t *conn,
                                          origin_circuit_t *circ,
                                          int dry_run)
 {
   if (! conn->original_dest_address) {
     log_warn(LD_BUG, "Reached connection_update_circuit_isolation without "
              "having set conn->original_dest_address");
-    ((edge_connection_t*)conn)->original_dest_address =
+    ((entry_connection_t*)conn)->original_dest_address =
       tor_strdup(conn->socks_request->address);
   }
 
@@ -3465,9 +3479,9 @@ connection_edge_update_circuit_isolation(const edge_connection_t *conn,
       return -1;
     circ->dest_port = conn->socks_request->port;
     circ->dest_address = tor_strdup(conn->original_dest_address);
-    circ->client_proto_type = TO_CONN(conn)->type;
+    circ->client_proto_type = ENTRY_TO_CONN(conn)->type;
     circ->client_proto_socksver = conn->socks_request->socks_version;
-    tor_addr_copy(&circ->client_addr, &TO_CONN(conn)->addr);
+    tor_addr_copy(&circ->client_addr, &ENTRY_TO_CONN(conn)->addr);
     circ->session_group = conn->session_group;
     circ->nym_epoch = conn->nym_epoch;
     circ->socks_username = conn->socks_request->username ?
@@ -3486,10 +3500,10 @@ connection_edge_update_circuit_isolation(const edge_connection_t *conn,
     if (strcmp_opt(conn->socks_request->username, circ->socks_username) ||
         strcmp_opt(conn->socks_request->password, circ->socks_password))
       mixed |= ISO_SOCKSAUTH;
-    if ((TO_CONN(conn)->type != circ->client_proto_type ||
+    if ((ENTRY_TO_CONN(conn)->type != circ->client_proto_type ||
          conn->socks_request->socks_version != circ->client_proto_socksver))
       mixed |= ISO_CLIENTPROTO;
-    if (!tor_addr_eq(&TO_CONN(conn)->addr, &circ->client_addr))
+    if (!tor_addr_eq(&ENTRY_TO_CONN(conn)->addr, &circ->client_addr))
       mixed |= ISO_CLIENTADDR;
     if (conn->session_group != circ->session_group)
       mixed |= ISO_SESSIONGRP;
diff --git a/src/or/connection_edge.h b/src/or/connection_edge.h
index 85293a091..cf60cf469 100644
--- a/src/or/connection_edge.h
+++ b/src/or/connection_edge.h
@@ -15,7 +15,7 @@
 #define connection_mark_unattached_ap(conn, endreason) \
   _connection_mark_unattached_ap((conn), (endreason), __LINE__, _SHORT_FILE_)
 
-void _connection_mark_unattached_ap(edge_connection_t *conn, int endreason,
+void _connection_mark_unattached_ap(entry_connection_t *conn, int endreason,
                                     int line, const char *file);
 int connection_edge_reached_eof(edge_connection_t *conn);
 int connection_edge_process_inbuf(edge_connection_t *conn,
@@ -27,22 +27,22 @@ int connection_edge_flushed_some(edge_connection_t *conn);
 int connection_edge_finished_flushing(edge_connection_t *conn);
 int connection_edge_finished_connecting(edge_connection_t *conn);
 
-void connection_ap_about_to_close(edge_connection_t *edge_conn);
+void connection_ap_about_to_close(entry_connection_t *edge_conn);
 void connection_exit_about_to_close(edge_connection_t *edge_conn);
 
-int connection_ap_handshake_send_begin(edge_connection_t *ap_conn);
-int connection_ap_handshake_send_resolve(edge_connection_t *ap_conn);
+int connection_ap_handshake_send_begin(entry_connection_t *ap_conn);
+int connection_ap_handshake_send_resolve(entry_connection_t *ap_conn);
 
-edge_connection_t  *connection_ap_make_link(connection_t *partner,
+entry_connection_t  *connection_ap_make_link(connection_t *partner,
                                             char *address, uint16_t port,
                                             const char *digest,
                                             int session_group,
                                             int isolation_flags,
                                             int use_begindir, int want_onehop);
-void connection_ap_handshake_socks_reply(edge_connection_t *conn, char *reply,
+void connection_ap_handshake_socks_reply(entry_connection_t *conn, char *reply,
                                          size_t replylen,
                                          int endreason);
-void connection_ap_handshake_socks_resolved(edge_connection_t *conn,
+void connection_ap_handshake_socks_resolved(entry_connection_t *conn,
                                             int answer_type,
                                             size_t answer_len,
                                             const uint8_t *answer,
@@ -53,17 +53,17 @@ int connection_exit_begin_conn(cell_t *cell, circuit_t *circ);
 int connection_exit_begin_resolve(cell_t *cell, or_circuit_t *circ);
 void connection_exit_connect(edge_connection_t *conn);
 int connection_edge_is_rendezvous_stream(edge_connection_t *conn);
-int connection_ap_can_use_exit(const edge_connection_t *conn,
+int connection_ap_can_use_exit(const entry_connection_t *conn,
                                const node_t *exit);
 void connection_ap_expire_beginning(void);
 void connection_ap_attach_pending(void);
 void connection_ap_fail_onehop(const char *failed_digest,
                                cpath_build_state_t *build_state);
 void circuit_discard_optional_exit_enclaves(extend_info_t *info);
-int connection_ap_detach_retriable(edge_connection_t *conn,
+int connection_ap_detach_retriable(entry_connection_t *conn,
                                    origin_circuit_t *circ,
                                    int reason);
-int connection_ap_process_transparent(edge_connection_t *conn);
+int connection_ap_process_transparent(entry_connection_t *conn);
 
 int address_is_invalid_destination(const char *address, int client);
 
@@ -88,10 +88,10 @@ void client_dns_set_addressmap(const char *address, uint32_t val,
 const char *addressmap_register_virtual_address(int type, char *new_address);
 void addressmap_get_mappings(smartlist_t *sl, time_t min_expires,
                              time_t max_expires, int want_expiry);
-int connection_ap_rewrite_and_attach_if_allowed(edge_connection_t *conn,
+int connection_ap_rewrite_and_attach_if_allowed(entry_connection_t *conn,
                                                 origin_circuit_t *circ,
                                                 crypt_path_t *cpath);
-int connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn,
+int connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn,
                                                origin_circuit_t *circ,
                                                crypt_path_t *cpath);
 
@@ -105,11 +105,11 @@ hostname_type_t parse_extended_hostname(char *address, int allowdotexit);
 int get_pf_socket(void);
 #endif
 
-int connection_edge_streams_are_compatible(const edge_connection_t *a,
-                                           const edge_connection_t *b);
-int connection_edge_compatible_with_circuit(const edge_connection_t *conn,
+int connection_edge_streams_are_compatible(const entry_connection_t *a,
+                                           const entry_connection_t *b);
+int connection_edge_compatible_with_circuit(const entry_connection_t *conn,
                                             const origin_circuit_t *circ);
-int connection_edge_update_circuit_isolation(const edge_connection_t *conn,
+int connection_edge_update_circuit_isolation(const entry_connection_t *conn,
                                              origin_circuit_t *circ,
                                              int dry_run);
 void circuit_clear_isolation(origin_circuit_t *circ);
diff --git a/src/or/control.c b/src/or/control.c
index ad11350fb..6a44730f2 100644
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -176,7 +176,7 @@ static int handle_control_resolve(control_connection_t *conn, uint32_t len,
 static int handle_control_usefeature(control_connection_t *conn,
                                      uint32_t len,
                                      const char *body);
-static int write_stream_target_to_buf(edge_connection_t *conn, char *buf,
+static int write_stream_target_to_buf(entry_connection_t *conn, char *buf,
                                       size_t len);
 static void orconn_target_get_name(char *buf, size_t len,
                                    or_connection_t *conn);
@@ -655,7 +655,7 @@ get_circ(const char *id)
 }
 
 /** Given a text stream <b>id</b>, return the corresponding AP connection. */
-static edge_connection_t *
+static entry_connection_t *
 get_stream(const char *id)
 {
   uint64_t n_id;
@@ -667,7 +667,7 @@ get_stream(const char *id)
   conn = connection_get_by_global_id(n_id);
   if (!conn || conn->type != CONN_TYPE_AP || conn->marked_for_close)
     return NULL;
-  return TO_EDGE_CONN(conn);
+  return TO_ENTRY_CONN(conn);
 }
 
 /** Helper for setconf and resetconf. Acts like setconf, except
@@ -1800,7 +1800,7 @@ getinfo_helper_events(control_connection_t *control_conn,
     char buf[256];
     SMARTLIST_FOREACH_BEGIN(conns, connection_t *, base_conn) {
       const char *state;
-      edge_connection_t *conn;
+      entry_connection_t *conn;
       char *s;
       size_t slen;
       circuit_t *circ;
@@ -1810,8 +1810,8 @@ getinfo_helper_events(control_connection_t *control_conn,
           base_conn->state == AP_CONN_STATE_SOCKS_WAIT ||
           base_conn->state == AP_CONN_STATE_NATD_WAIT)
         continue;
-      conn = TO_EDGE_CONN(base_conn);
-      switch (conn->_base.state)
+      conn = TO_ENTRY_CONN(base_conn);
+      switch (base_conn->state)
         {
         case AP_CONN_STATE_CONTROLLER_WAIT:
         case AP_CONN_STATE_CIRCUIT_WAIT:
@@ -1830,17 +1830,17 @@ getinfo_helper_events(control_connection_t *control_conn,
           state = "SUCCEEDED"; break;
         default:
           log_warn(LD_BUG, "Asked for stream in unknown state %d",
-                   conn->_base.state);
+                   base_conn->state);
           continue;
         }
-      circ = circuit_get_by_edge_conn(conn);
+      circ = circuit_get_by_edge_conn(ENTRY_TO_EDGE_CONN(conn));
       if (circ && CIRCUIT_IS_ORIGIN(circ))
         origin_circ = TO_ORIGIN_CIRCUIT(circ);
       write_stream_target_to_buf(conn, buf, sizeof(buf));
       slen = strlen(buf)+strlen(state)+32;
       s = tor_malloc(slen+1);
       tor_snprintf(s, slen, "%lu %s %lu %s",
-                   (unsigned long) conn->_base.global_identifier,state,
+                   (unsigned long) base_conn->global_identifier,state,
                    origin_circ?
                          (unsigned long)origin_circ->global_identifier : 0ul,
                    buf);
@@ -2460,7 +2460,7 @@ static int
 handle_control_attachstream(control_connection_t *conn, uint32_t len,
                             const char *body)
 {
-  edge_connection_t *ap_conn = NULL;
+  entry_connection_t *ap_conn = NULL;
   origin_circuit_t *circ = NULL;
   int zero_circ;
   smartlist_t *args;
@@ -2496,9 +2496,9 @@ handle_control_attachstream(control_connection_t *conn, uint32_t len,
   if (!ap_conn || (!zero_circ && !circ) || !hop_line_ok)
     return 0;
 
-  if (ap_conn->_base.state != AP_CONN_STATE_CONTROLLER_WAIT &&
-      ap_conn->_base.state != AP_CONN_STATE_CONNECT_WAIT &&
-      ap_conn->_base.state != AP_CONN_STATE_RESOLVE_WAIT) {
+  if (ENTRY_TO_CONN(ap_conn)->state != AP_CONN_STATE_CONTROLLER_WAIT &&
+      ENTRY_TO_CONN(ap_conn)->state != AP_CONN_STATE_CONNECT_WAIT &&
+      ENTRY_TO_CONN(ap_conn)->state != AP_CONN_STATE_RESOLVE_WAIT) {
     connection_write_str_to_buf(
                     "555 Connection is not managed by controller.\r\n",
                     conn);
@@ -2506,15 +2506,16 @@ handle_control_attachstream(control_connection_t *conn, uint32_t len,
   }
 
   /* Do we need to detach it first? */
-  if (ap_conn->_base.state != AP_CONN_STATE_CONTROLLER_WAIT) {
-    circuit_t *tmpcirc = circuit_get_by_edge_conn(ap_conn);
-    connection_edge_end(ap_conn, END_STREAM_REASON_TIMEOUT);
+  if (ENTRY_TO_CONN(ap_conn)->state != AP_CONN_STATE_CONTROLLER_WAIT) {
+    edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
+    circuit_t *tmpcirc = circuit_get_by_edge_conn(edge_conn);
+    connection_edge_end(edge_conn, END_STREAM_REASON_TIMEOUT);
     /* Un-mark it as ending, since we're going to reuse it. */
-    ap_conn->edge_has_sent_end = 0;
-    ap_conn->end_reason = 0;
+    edge_conn->edge_has_sent_end = 0;
+    edge_conn->end_reason = 0;
     if (tmpcirc)
-      circuit_detach_stream(tmpcirc,ap_conn);
-    ap_conn->_base.state = AP_CONN_STATE_CONTROLLER_WAIT;
+      circuit_detach_stream(tmpcirc, edge_conn);
+    TO_CONN(edge_conn)->state = AP_CONN_STATE_CONTROLLER_WAIT;
   }
 
   if (circ && (circ->_base.state != CIRCUIT_STATE_OPEN)) {
@@ -2636,7 +2637,7 @@ static int
 handle_control_redirectstream(control_connection_t *conn, uint32_t len,
                               const char *body)
 {
-  edge_connection_t *ap_conn = NULL;
+  entry_connection_t *ap_conn = NULL;
   char *new_addr = NULL;
   uint16_t new_port = 0;
   smartlist_t *args;
@@ -2684,7 +2685,7 @@ static int
 handle_control_closestream(control_connection_t *conn, uint32_t len,
                            const char *body)
 {
-  edge_connection_t *ap_conn=NULL;
+  entry_connection_t *ap_conn=NULL;
   uint8_t reason=0;
   smartlist_t *args;
   int ok;
@@ -3264,7 +3265,7 @@ control_event_circuit_status(origin_circuit_t *circ, circuit_status_event_t tp,
  * <b>conn</b>, and write it to <b>buf</b>.  Return 0 on success, -1 on
  * failure. */
 static int
-write_stream_target_to_buf(edge_connection_t *conn, char *buf, size_t len)
+write_stream_target_to_buf(entry_connection_t *conn, char *buf, size_t len)
 {
   char buf2[256];
   if (conn->chosen_exit_name)
@@ -3275,8 +3276,8 @@ write_stream_target_to_buf(edge_connection_t *conn, char *buf, size_t len)
   if (tor_snprintf(buf, len, "%s%s%s:%d",
                conn->socks_request->address,
                conn->chosen_exit_name ? buf2 : "",
-               !conn->chosen_exit_name &&
-                 connection_edge_is_rendezvous_stream(conn) ? ".onion" : "",
+               !conn->chosen_exit_name && connection_edge_is_rendezvous_stream(
+                                     ENTRY_TO_EDGE_CONN(conn)) ? ".onion" : "",
                conn->socks_request->port)<0)
     return -1;
   return 0;
@@ -3285,7 +3286,7 @@ write_stream_target_to_buf(edge_connection_t *conn, char *buf, size_t len)
 /** Something has happened to the stream associated with AP connection
  * <b>conn</b>: tell any interested control connections. */
 int
-control_event_stream_status(edge_connection_t *conn, stream_status_event_t tp,
+control_event_stream_status(entry_connection_t *conn, stream_status_event_t tp,
                             int reason_code)
 {
   char reason_buf[64];
@@ -3357,7 +3358,7 @@ control_event_stream_status(edge_connection_t *conn, stream_status_event_t tp,
 
   if (tp == STREAM_EVENT_NEW) {
     tor_snprintf(addrport_buf,sizeof(addrport_buf), " SOURCE_ADDR=%s:%d",
-                 TO_CONN(conn)->address, TO_CONN(conn)->port );
+                 ENTRY_TO_CONN(conn)->address, ENTRY_TO_CONN(conn)->port);
   } else {
     addrport_buf[0] = '\0';
   }
@@ -3365,12 +3366,12 @@ control_event_stream_status(edge_connection_t *conn, stream_status_event_t tp,
   if (tp == STREAM_EVENT_NEW_RESOLVE) {
     purpose = " PURPOSE=DNS_REQUEST";
   } else if (tp == STREAM_EVENT_NEW) {
-    if (conn->is_dns_request ||
+    if (ENTRY_TO_EDGE_CONN(conn)->is_dns_request ||
         (conn->socks_request &&
          SOCKS_COMMAND_IS_RESOLVE(conn->socks_request->command)))
       purpose = " PURPOSE=DNS_REQUEST";
     else if (conn->use_begindir) {
-      connection_t *linked = TO_CONN(conn)->linked_conn;
+      connection_t *linked = ENTRY_TO_CONN(conn)->linked_conn;
       int linked_dir_purpose = -1;
       if (linked && linked->type == CONN_TYPE_DIR)
         linked_dir_purpose = linked->purpose;
@@ -3382,12 +3383,13 @@ control_event_stream_status(edge_connection_t *conn, stream_status_event_t tp,
       purpose = " PURPOSE=USER";
   }
 
-  circ = circuit_get_by_edge_conn(conn);
+  circ = circuit_get_by_edge_conn(ENTRY_TO_EDGE_CONN(conn));
   if (circ && CIRCUIT_IS_ORIGIN(circ))
     origin_circ = TO_ORIGIN_CIRCUIT(circ);
   send_control_event(EVENT_STREAM_STATUS, ALL_FORMATS,
                         "650 STREAM "U64_FORMAT" %s %lu %s%s%s%s\r\n",
-                        U64_PRINTF_ARG(conn->_base.global_identifier), status,
+                     U64_PRINTF_ARG(ENTRY_TO_CONN(conn)->global_identifier),
+                     status,
                         origin_circ?
                            (unsigned long)origin_circ->global_identifier : 0ul,
                         buf, reason_buf, addrport_buf, purpose);
diff --git a/src/or/control.h b/src/or/control.h
index 147a5af0b..365518469 100644
--- a/src/or/control.h
+++ b/src/or/control.h
@@ -37,7 +37,7 @@ int control_event_is_interesting(int event);
 
 int control_event_circuit_status(origin_circuit_t *circ,
                                  circuit_status_event_t e, int reason);
-int control_event_stream_status(edge_connection_t *conn,
+int control_event_stream_status(entry_connection_t *conn,
                                 stream_status_event_t e,
                                 int reason);
 int control_event_or_conn_status(or_connection_t *conn,
diff --git a/src/or/directory.c b/src/or/directory.c
index 744bc120f..16bea8256 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -972,7 +972,7 @@ directory_initiate_command_rend(const char *address, const tor_addr_t *_addr,
            error indicates broken link in windowsland. */
     }
   } else { /* we want to connect via a tor connection */
-    edge_connection_t *linked_conn;
+    entry_connection_t *linked_conn;
     /* Anonymized tunneled connections can never share a circuit.
      * One-hop directory connections can share circuits with each other
      * but nothing else. */
@@ -1014,10 +1014,11 @@ directory_initiate_command_rend(const char *address, const tor_addr_t *_addr,
                            if_modified_since);
 
     connection_watch_events(TO_CONN(conn), READ_EVENT|WRITE_EVENT);
-    IF_HAS_BUFFEREVENT(TO_CONN(linked_conn), {
-      connection_watch_events(TO_CONN(linked_conn), READ_EVENT|WRITE_EVENT);
+    IF_HAS_BUFFEREVENT(ENTRY_TO_CONN(linked_conn), {
+      connection_watch_events(ENTRY_TO_CONN(linked_conn),
+                              READ_EVENT|WRITE_EVENT);
     }) ELSE_IF_NO_BUFFEREVENT
-      connection_start_reading(TO_CONN(linked_conn));
+      connection_start_reading(ENTRY_TO_CONN(linked_conn));
   }
 }
 
diff --git a/src/or/dnsserv.c b/src/or/dnsserv.c
index 6df581f9b..a54530c2b 100644
--- a/src/or/dnsserv.c
+++ b/src/or/dnsserv.c
@@ -118,7 +118,7 @@ evdns_server_callback(struct evdns_server_request *req, void *data_)
   /* Make a new dummy AP connection, and attach the request to it. */
   entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
   conn = ENTRY_TO_EDGE_CONN(entry_conn);
-  conn->_base.state = AP_CONN_STATE_RESOLVE_WAIT;
+  TO_CONN(conn)->state = AP_CONN_STATE_RESOLVE_WAIT;
   conn->is_dns_request = 1;
 
   tor_addr_copy(&TO_CONN(conn)->addr, &tor_addr);
@@ -126,26 +126,26 @@ evdns_server_callback(struct evdns_server_request *req, void *data_)
   TO_CONN(conn)->address = tor_dup_addr(&tor_addr);
 
   if (q->type == EVDNS_TYPE_A)
-    conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
+    entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
   else
-    conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
+    entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
 
-  strlcpy(conn->socks_request->address, q->name,
-          sizeof(conn->socks_request->address));
+  strlcpy(entry_conn->socks_request->address, q->name,
+          sizeof(entry_conn->socks_request->address));
 
-  conn->dns_server_request = req;
-  conn->isolation_flags = listener->isolation_flags;
-  conn->session_group = listener->session_group;
-  conn->nym_epoch = get_signewnym_epoch();
+  entry_conn->dns_server_request = req;
+  entry_conn->isolation_flags = listener->isolation_flags;
+  entry_conn->session_group = listener->session_group;
+  entry_conn->nym_epoch = get_signewnym_epoch();
 
-  if (connection_add(TO_CONN(conn)) < 0) {
+  if (connection_add(ENTRY_TO_CONN(entry_conn)) < 0) {
     log_warn(LD_APP, "Couldn't register dummy connection for DNS request");
     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
-    connection_free(TO_CONN(conn));
+    connection_free(ENTRY_TO_CONN(entry_conn));
     return;
   }
 
-  control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
+  control_event_stream_status(entry_conn, STREAM_EVENT_NEW, 0);
 
   /* Now, unless a controller asked us to leave streams unattached,
   * throw the connection over to get rewritten (which will
@@ -154,7 +154,7 @@ evdns_server_callback(struct evdns_server_request *req, void *data_)
   log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
            escaped_safe_str_client(q->name));
   q_name = tor_strdup(q->name); /* q could be freed in rewrite_and_attach */
-  connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
+  connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
   /* Now, the connection is marked if it was bad. */
 
   log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
@@ -180,19 +180,19 @@ dnsserv_launch_request(const char *name, int reverse)
   conn->_base.state = AP_CONN_STATE_RESOLVE_WAIT;
 
   if (reverse)
-    conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
+    entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
   else
-    conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
+    entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
 
   conn->is_dns_request = 1;
 
-  strlcpy(conn->socks_request->address, name,
-          sizeof(conn->socks_request->address));
+  strlcpy(entry_conn->socks_request->address, name,
+          sizeof(entry_conn->socks_request->address));
 
-  conn->original_dest_address = tor_strdup(name);
-  conn->session_group = SESSION_GROUP_CONTROL_RESOLVE;
-  conn->nym_epoch = get_signewnym_epoch();
-  conn->isolation_flags = ISO_DEFAULT;
+  entry_conn->original_dest_address = tor_strdup(name);
+  entry_conn->session_group = SESSION_GROUP_CONTROL_RESOLVE;
+  entry_conn->nym_epoch = get_signewnym_epoch();
+  entry_conn->isolation_flags = ISO_DEFAULT;
 
   if (connection_add(TO_CONN(conn))<0) {
     log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request");
@@ -207,7 +207,7 @@ dnsserv_launch_request(const char *name, int reverse)
   log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
            escaped_safe_str_client(name));
   q_name = tor_strdup(name); /* q could be freed in rewrite_and_attach */
-  connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
+  connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
   /* Now, the connection is marked if it was bad. */
 
   log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
@@ -219,7 +219,7 @@ dnsserv_launch_request(const char *name, int reverse)
 /** If there is a pending request on <b>conn</b> that's waiting for an answer,
  * send back an error and free the request. */
 void
-dnsserv_reject_request(edge_connection_t *conn)
+dnsserv_reject_request(entry_connection_t *conn)
 {
   if (conn->dns_server_request) {
     evdns_server_request_respond(conn->dns_server_request,
@@ -265,7 +265,7 @@ evdns_get_orig_address(const struct evdns_server_request *req,
  * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>.  Doesn't do
  * any caching; that's handled elsewhere. */
 void
-dnsserv_resolved(edge_connection_t *conn,
+dnsserv_resolved(entry_connection_t *conn,
                  int answer_type,
                  size_t answer_len,
                  const char *answer,
diff --git a/src/or/dnsserv.h b/src/or/dnsserv.h
index fcca86888..73ec36564 100644
--- a/src/or/dnsserv.h
+++ b/src/or/dnsserv.h
@@ -14,12 +14,12 @@
 
 void dnsserv_configure_listener(connection_t *conn);
 void dnsserv_close_listener(connection_t *conn);
-void dnsserv_resolved(edge_connection_t *conn,
+void dnsserv_resolved(entry_connection_t *conn,
                       int answer_type,
                       size_t answer_len,
                       const char *answer,
                       int ttl);
-void dnsserv_reject_request(edge_connection_t *conn);
+void dnsserv_reject_request(entry_connection_t *conn);
 int dnsserv_launch_request(const char *name, int is_reverse);
 
 #endif
diff --git a/src/or/hibernate.c b/src/or/hibernate.c
index f03433a27..defb7029e 100644
--- a/src/or/hibernate.c
+++ b/src/or/hibernate.c
@@ -856,7 +856,7 @@ hibernate_go_dormant(time_t now)
       connection_edge_end(TO_EDGE_CONN(conn), END_STREAM_REASON_HIBERNATING);
     log_info(LD_NET,"Closing conn type %d", conn->type);
     if (conn->type == CONN_TYPE_AP) /* send socks failure if needed */
-      connection_mark_unattached_ap(TO_EDGE_CONN(conn),
+      connection_mark_unattached_ap(TO_ENTRY_CONN(conn),
                                     END_STREAM_REASON_HIBERNATING);
     else
       connection_mark_for_close(conn);
diff --git a/src/or/main.c b/src/or/main.c
index 54e6451e6..6866ccc8c 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -859,13 +859,13 @@ directory_all_unreachable(time_t now)
 
   while ((conn = connection_get_by_type_state(CONN_TYPE_AP,
                                               AP_CONN_STATE_CIRCUIT_WAIT))) {
-    edge_connection_t *edge_conn = TO_EDGE_CONN(conn);
+    entry_connection_t *entry_conn = TO_ENTRY_CONN(conn);
     log_notice(LD_NET,
                "Is your network connection down? "
                "Failing connection to '%s:%d'.",
-               safe_str_client(edge_conn->socks_request->address),
-               edge_conn->socks_request->port);
-    connection_mark_unattached_ap(edge_conn,
+               safe_str_client(entry_conn->socks_request->address),
+               entry_conn->socks_request->port);
+    connection_mark_unattached_ap(entry_conn,
                                   END_STREAM_REASON_NET_UNREACHABLE);
   }
   control_event_general_status(LOG_ERR, "DIR_ALL_UNREACHABLE");
diff --git a/src/or/or.h b/src/or/or.h
index cebac3f21..ca1433efc 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -1181,20 +1181,20 @@ typedef struct edge_connection_t {
 
   struct edge_connection_t *next_stream; /**< Points to the next stream at this
                                           * edge, if any */
-  struct crypt_path_t *cpath_layer; /**< A pointer to which node in the circ
-                                     * this conn exits at. */
   int package_window; /**< How many more relay cells can I send into the
                        * circuit? */
   int deliver_window; /**< How many more relay cells can end at me? */
 
-  /** Nickname of planned exit node -- used with .exit support. */
-  char *chosen_exit_name;
-
-  socks_request_t *socks_request; /**< SOCKS structure describing request (AP
-                                   * only.) */
   struct circuit_t *on_circuit; /**< The circuit (if any) that this edge
                                  * connection is using. */
 
+  /** A pointer to which node in the circ this conn exits at.  Set for AP
+   * connections and for hidden service exit connections. */
+  struct crypt_path_t *cpath_layer;
+  /** What rendezvous service are we querying for (if an AP) or providing (if
+   * an exit)? */
+  rend_data_t *rend_data;
+
   uint32_t address_ttl; /**< TTL for address-to-addr mapping on exit
                          * connection.  Exit connections only. */
 
@@ -1210,8 +1210,29 @@ typedef struct edge_connection_t {
   /** Bytes written since last call to control_event_stream_bandwidth_used() */
   uint32_t n_written;
 
-  /** What rendezvous service are we querying for? (AP only) */
-  rend_data_t *rend_data;
+  /** True iff this connection is for a DNS request only. */
+  unsigned int is_dns_request:1;
+
+  unsigned int edge_has_sent_end:1; /**< For debugging; only used on edge
+                         * connections.  Set once we've set the stream end,
+                         * and check in connection_about_to_close_connection().
+                         */
+  /** True iff we've blocked reading until the circuit has fewer queued
+   * cells. */
+  unsigned int edge_blocked_on_circ:1;
+
+} edge_connection_t;
+
+/** Subtype of edge_connection_t for an "entry connection" -- that is, a SOCKS
+ * connection, a DNS request, a TransPort connection or a NATD connection */
+typedef struct entry_connection_t {
+  edge_connection_t _edge;
+
+  /** Nickname of planned exit node -- used with .exit support. */
+  char *chosen_exit_name;
+
+  socks_request_t *socks_request; /**< SOCKS structure describing request (AP
+                                   * only.) */
 
   /* === Isolation related, AP only. === */
   /** AP only: based on which factors do we isolate this stream? */
@@ -1232,6 +1253,19 @@ typedef struct edge_connection_t {
    * already retried several times. */
   uint8_t num_socks_retries;
 
+  /** For AP connections only: buffer for data that we have sent
+   * optimistically, which we might need to re-send if we have to
+   * retry this connection. */
+  generic_buffer_t *pending_optimistic_data;
+  /* For AP connections only: buffer for data that we previously sent
+  * optimistically which we are currently re-sending as we retry this
+  * connection. */
+  generic_buffer_t *sending_optimistic_data;
+
+  /** If this is a DNSPort connection, this field holds the pending DNS
+   * request that we're going to try to answer.  */
+  struct evdns_server_request *dns_server_request;
+
 #define NUM_CIRCUITS_LAUNCHED_THRESHOLD 10
   /** Number of times we've launched a circuit to handle this stream. If
     * it gets too high, that could indicate an inconsistency between our
@@ -1239,9 +1273,6 @@ typedef struct edge_connection_t {
     * stream to one of the available circuits" logic. */
   unsigned int num_circuits_launched:4;
 
-  /** True iff this connection is for a DNS request only. */
-  unsigned int is_dns_request:1;
-
   /** True iff this stream must attach to a one-hop circuit (e.g. for
    * begin_dir). */
   unsigned int want_onehop:1;
@@ -1249,13 +1280,6 @@ typedef struct edge_connection_t {
    * itself rather than BEGIN (either via onehop or via a whole circuit). */
   unsigned int use_begindir:1;
 
-  unsigned int edge_has_sent_end:1; /**< For debugging; only used on edge
-                         * connections.  Set once we've set the stream end,
-                         * and check in connection_about_to_close_connection().
-                         */
-  /** True iff we've blocked reading until the circuit has fewer queued
-   * cells. */
-  unsigned int edge_blocked_on_circ:1;
   /** For AP connections only. If 1, and we fail to reach the chosen exit,
    * stop requiring it. */
   unsigned int chosen_exit_optional:1;
@@ -1275,26 +1299,6 @@ typedef struct edge_connection_t {
    */
   unsigned int may_use_optimistic_data : 1;
 
-  /** For AP connections only: buffer for data that we have sent
-   * optimistically, which we might need to re-send if we have to
-   * retry this connection. */
-  generic_buffer_t *pending_optimistic_data;
-  /* For AP connections only: buffer for data that we previously sent
-  * optimistically which we are currently re-sending as we retry this
-  * connection. */
-  generic_buffer_t *sending_optimistic_data;
-
-  /** If this is a DNSPort connection, this field holds the pending DNS
-   * request that we're going to try to answer.  */
-  struct evdns_server_request *dns_server_request;
-
-} edge_connection_t;
-
-/** Subtype of edge_connection_t for an "entry connection" -- that is, a SOCKS
- * connection, a DNS request, a TransPort connection or a NATD connection */
-typedef struct entry_connection_t {
-  edge_connection_t _edge;
-
 } entry_connection_t;
 
 /** Subtype of connection_t for an "directory connection" -- that is, an HTTP
@@ -1385,6 +1389,9 @@ static edge_connection_t *TO_EDGE_CONN(connection_t *);
 /** Convert a connection_t* to an entry_connection_t*; assert if the cast is
  * invalid. */
 static entry_connection_t *TO_ENTRY_CONN(connection_t *);
+/** Convert a edge_connection_t* to an entry_connection_t*; assert if the cast is
+ * invalid. */
+static entry_connection_t *EDGE_TO_ENTRY_CONN(edge_connection_t *);
 /** Convert a connection_t* to an control_connection_t*; assert if the cast is
  * invalid. */
 static control_connection_t *TO_CONTROL_CONN(connection_t *);
@@ -1413,6 +1420,11 @@ static INLINE entry_connection_t *TO_ENTRY_CONN(connection_t *c)
   tor_assert(c->magic == ENTRY_CONNECTION_MAGIC);
   return (entry_connection_t*) SUBTYPE_P(c, entry_connection_t, _edge._base);
 }
+static INLINE entry_connection_t *EDGE_TO_ENTRY_CONN(edge_connection_t *c)
+{
+  tor_assert(c->_base.magic == ENTRY_CONNECTION_MAGIC);
+  return (entry_connection_t*) SUBTYPE_P(c, entry_connection_t, _edge);
+}
 static INLINE control_connection_t *TO_CONTROL_CONN(connection_t *c)
 {
   tor_assert(c->magic == CONTROL_CONNECTION_MAGIC);
diff --git a/src/or/relay.c b/src/or/relay.c
index 3fa31a3f3..5bbcf0a53 100644
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -649,6 +649,7 @@ connection_edge_send_command(edge_connection_t *fromconn,
 {
   /* XXXX NM Split this function into a separate versions per circuit type? */
   circuit_t *circ;
+  crypt_path_t *cpath_layer = fromconn->cpath_layer;
   tor_assert(fromconn);
   circ = fromconn->on_circuit;
 
@@ -663,7 +664,8 @@ connection_edge_send_command(edge_connection_t *fromconn,
   if (!circ) {
     if (fromconn->_base.type == CONN_TYPE_AP) {
       log_info(LD_APP,"no circ. Closing conn.");
-      connection_mark_unattached_ap(fromconn, END_STREAM_REASON_INTERNAL);
+      connection_mark_unattached_ap(EDGE_TO_ENTRY_CONN(fromconn),
+                                    END_STREAM_REASON_INTERNAL);
     } else {
       log_info(LD_EXIT,"no circ. Closing conn.");
       fromconn->edge_has_sent_end = 1; /* no circ to send to */
@@ -675,7 +677,7 @@ connection_edge_send_command(edge_connection_t *fromconn,
 
   return relay_send_command_from_edge(fromconn->stream_id, circ,
                                       relay_command, payload,
-                                      payload_len, fromconn->cpath_layer);
+                                      payload_len, cpath_layer);
 }
 
 /** How many times will I retry a stream that fails due to DNS
@@ -703,16 +705,17 @@ edge_reason_is_retriable(int reason)
 static int
 connection_ap_process_end_not_open(
     relay_header_t *rh, cell_t *cell, origin_circuit_t *circ,
-    edge_connection_t *conn, crypt_path_t *layer_hint)
+    entry_connection_t *conn, crypt_path_t *layer_hint)
 {
   struct in_addr in;
   node_t *exitrouter;
   int reason = *(cell->payload+RELAY_HEADER_SIZE);
   int control_reason = reason | END_STREAM_REASON_FLAG_REMOTE;
+  edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(conn);
   (void) layer_hint; /* unused */
 
   if (rh->length > 0 && edge_reason_is_retriable(reason) &&
-      !connection_edge_is_rendezvous_stream(conn)  /* avoid retry if rend */
+      !connection_edge_is_rendezvous_stream(edge_conn) /* avoid retry if rend */
       ) {
     const char *chosen_exit_digest =
       circ->build_state->chosen_exit->identity_digest;
@@ -840,7 +843,7 @@ connection_ap_process_end_not_open(
        stream_end_reason_to_string(rh->length > 0 ? reason : -1));
   circuit_log_path(LOG_INFO,LD_APP,circ);
   /* need to test because of detach_retriable */
-  if (!conn->_base.marked_for_close)
+  if (!ENTRY_TO_CONN(conn)->marked_for_close)
     connection_mark_unattached_ap(conn, control_reason);
   return 0;
 }
@@ -849,7 +852,7 @@ connection_ap_process_end_not_open(
  * dotted-quad representation of <b>new_addr</b> (given in host order),
  * and send an appropriate REMAP event. */
 static void
-remap_event_helper(edge_connection_t *conn, uint32_t new_addr)
+remap_event_helper(entry_connection_t *conn, uint32_t new_addr)
 {
   struct in_addr in;
 
@@ -875,7 +878,8 @@ connection_edge_process_relay_cell_not_open(
   if (rh->command == RELAY_COMMAND_END) {
     if (CIRCUIT_IS_ORIGIN(circ) && conn->_base.type == CONN_TYPE_AP) {
       return connection_ap_process_end_not_open(rh, cell,
-                                                TO_ORIGIN_CIRCUIT(circ), conn,
+                                                TO_ORIGIN_CIRCUIT(circ),
+                                                EDGE_TO_ENTRY_CONN(conn),
                                                 layer_hint);
     } else {
       /* we just got an 'end', don't need to send one */
@@ -889,6 +893,7 @@ connection_edge_process_relay_cell_not_open(
 
   if (conn->_base.type == CONN_TYPE_AP &&
       rh->command == RELAY_COMMAND_CONNECTED) {
+    entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn);
     tor_assert(CIRCUIT_IS_ORIGIN(circ));
     if (conn->_base.state != AP_CONN_STATE_CONNECT_WAIT) {
       log_fn(LOG_PROTOCOL_WARN, LD_APP,
@@ -906,22 +911,23 @@ connection_edge_process_relay_cell_not_open(
         log_info(LD_APP, "...but it claims the IP address was %s. Closing.",
                  fmt_addr32(addr));
         connection_edge_end(conn, END_STREAM_REASON_TORPROTOCOL);
-        connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
+        connection_mark_unattached_ap(entry_conn,
+                                      END_STREAM_REASON_TORPROTOCOL);
         return 0;
       }
       if (rh->length >= 8)
         ttl = (int)ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+4));
       else
         ttl = -1;
-      client_dns_set_addressmap(conn->socks_request->address, addr,
-                                conn->chosen_exit_name, ttl);
+      client_dns_set_addressmap(entry_conn->socks_request->address, addr,
+                                entry_conn->chosen_exit_name, ttl);
 
-      remap_event_helper(conn, addr);
+      remap_event_helper(entry_conn, addr);
     }
     circuit_log_path(LOG_INFO,LD_APP,TO_ORIGIN_CIRCUIT(circ));
     /* don't send a socks reply to transparent conns */
-    if (!conn->socks_request->has_finished)
-      connection_ap_handshake_socks_reply(conn, NULL, 0, 0);
+    if (!entry_conn->socks_request->has_finished)
+      connection_ap_handshake_socks_reply(entry_conn, NULL, 0, 0);
 
     /* Was it a linked dir conn? If so, a dir request just started to
      * fetch something; this could be a bootstrap status milestone. */
@@ -946,9 +952,9 @@ connection_edge_process_relay_cell_not_open(
     }
     /* This is definitely a success, so forget about any pending data we
      * had sent. */
-    if (conn->pending_optimistic_data) {
-      generic_buffer_free(conn->pending_optimistic_data);
-      conn->pending_optimistic_data = NULL;
+    if (entry_conn->pending_optimistic_data) {
+      generic_buffer_free(entry_conn->pending_optimistic_data);
+      entry_conn->pending_optimistic_data = NULL;
     }
 
     /* handle anything that might have queued */
@@ -964,17 +970,18 @@ connection_edge_process_relay_cell_not_open(
     int ttl;
     int answer_len;
     uint8_t answer_type;
+    entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn);
     if (conn->_base.state != AP_CONN_STATE_RESOLVE_WAIT) {
       log_fn(LOG_PROTOCOL_WARN, LD_APP, "Got a 'resolved' cell while "
              "not in state resolve_wait. Dropping.");
       return 0;
     }
-    tor_assert(SOCKS_COMMAND_IS_RESOLVE(conn->socks_request->command));
+    tor_assert(SOCKS_COMMAND_IS_RESOLVE(entry_conn->socks_request->command));
     answer_len = cell->payload[RELAY_HEADER_SIZE+1];
     if (rh->length < 2 || answer_len+2>rh->length) {
       log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
              "Dropping malformed 'resolved' cell");
-      connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
+      connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TORPROTOCOL);
       return 0;
     }
     answer_type = cell->payload[RELAY_HEADER_SIZE];
@@ -989,14 +996,14 @@ connection_edge_process_relay_cell_not_open(
           is_internal_IP(addr, 0)) {
         log_info(LD_APP,"Got a resolve with answer %s. Rejecting.",
                  fmt_addr32(addr));
-        connection_ap_handshake_socks_resolved(conn,
+        connection_ap_handshake_socks_resolved(entry_conn,
                                                RESOLVED_TYPE_ERROR_TRANSIENT,
                                                0, NULL, 0, TIME_MAX);
-        connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
+        connection_mark_unattached_ap(entry_conn,END_STREAM_REASON_TORPROTOCOL);
         return 0;
       }
     }
-    connection_ap_handshake_socks_resolved(conn,
+    connection_ap_handshake_socks_resolved(entry_conn,
                    answer_type,
                    cell->payload[RELAY_HEADER_SIZE+1], /*answer_len*/
                    cell->payload+RELAY_HEADER_SIZE+2, /*answer*/
@@ -1004,9 +1011,9 @@ connection_edge_process_relay_cell_not_open(
                    -1);
     if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
       uint32_t addr = ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+2));
-      remap_event_helper(conn, addr);
+      remap_event_helper(entry_conn, addr);
     }
-    connection_mark_unattached_ap(conn,
+    connection_mark_unattached_ap(entry_conn,
                               END_STREAM_REASON_DONE |
                               END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
     return 0;
@@ -1164,9 +1171,13 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
                conn->_base.s,
                stream_end_reason_to_string(reason),
                conn->stream_id);
-      if (conn->socks_request && !conn->socks_request->has_finished)
-        log_warn(LD_BUG,
-                 "open stream hasn't sent socks answer yet? Closing.");
+      if (conn->_base.type == CONN_TYPE_AP) {
+        entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn);
+        if (entry_conn->socks_request &&
+            !entry_conn->socks_request->has_finished)
+          log_warn(LD_BUG,
+                   "open stream hasn't sent socks answer yet? Closing.");
+      }
       /* We just *got* an end; no reason to send one. */
       conn->edge_has_sent_end = 1;
       if (!conn->end_reason)
@@ -1348,11 +1359,14 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
   size_t amount_to_process, length;
   char payload[CELL_PAYLOAD_SIZE];
   circuit_t *circ;
-  unsigned domain = conn->cpath_layer ? LD_APP : LD_EXIT;
+  const unsigned domain = conn->_base.type == CONN_TYPE_AP ? LD_APP : LD_EXIT;
   int sending_from_optimistic = 0;
   const int sending_optimistically =
     conn->_base.type == CONN_TYPE_AP &&
     conn->_base.state != AP_CONN_STATE_OPEN;
+  entry_connection_t *entry_conn =
+    conn->_base.type == CONN_TYPE_AP ? EDGE_TO_ENTRY_CONN(conn) : NULL;
+  crypt_path_t *cpath_layer = conn->cpath_layer;
 
   tor_assert(conn);
 
@@ -1375,7 +1389,7 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
     return -1;
   }
 
-  if (circuit_consider_stop_edge_reading(circ, conn->cpath_layer))
+  if (circuit_consider_stop_edge_reading(circ, cpath_layer))
     return 0;
 
   if (conn->package_window <= 0) {
@@ -1385,10 +1399,11 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
     return 0;
   }
 
-  sending_from_optimistic = conn->sending_optimistic_data != NULL;
+  sending_from_optimistic = entry_conn &&
+    entry_conn->sending_optimistic_data != NULL;
 
   if (PREDICT_UNLIKELY(sending_from_optimistic)) {
-    amount_to_process = generic_buffer_len(conn->sending_optimistic_data);
+    amount_to_process = generic_buffer_len(entry_conn->sending_optimistic_data);
     if (PREDICT_UNLIKELY(!amount_to_process)) {
       log_warn(LD_BUG, "sending_optimistic_data was non-NULL but empty");
       amount_to_process = connection_get_inbuf_len(TO_CONN(conn));
@@ -1416,10 +1431,10 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
     /* XXX023 We could be more efficient here by sometimes packing
      * previously-sent optimistic data in the same cell with data
      * from the inbuf. */
-    generic_buffer_get(conn->sending_optimistic_data, payload, length);
-    if (!generic_buffer_len(conn->sending_optimistic_data)) {
-        generic_buffer_free(conn->sending_optimistic_data);
-        conn->sending_optimistic_data = NULL;
+    generic_buffer_get(entry_conn->sending_optimistic_data, payload, length);
+    if (!generic_buffer_len(entry_conn->sending_optimistic_data)) {
+        generic_buffer_free(entry_conn->sending_optimistic_data);
+        entry_conn->sending_optimistic_data = NULL;
     }
   } else {
     connection_fetch_from_buf(payload, length, TO_CONN(conn));
@@ -1431,9 +1446,9 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
   if (sending_optimistically && !sending_from_optimistic) {
     /* This is new optimistic data; remember it in case we need to detach and
        retry */
-    if (!conn->pending_optimistic_data)
-      conn->pending_optimistic_data = generic_buffer_new();
-    generic_buffer_add(conn->pending_optimistic_data, payload, length);
+    if (!entry_conn->pending_optimistic_data)
+      entry_conn->pending_optimistic_data = generic_buffer_new();
+    generic_buffer_add(entry_conn->pending_optimistic_data, payload, length);
   }
 
   if (connection_edge_send_command(conn, RELAY_COMMAND_DATA,
@@ -1441,18 +1456,18 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
     /* circuit got marked for close, don't continue, don't need to mark conn */
     return 0;
 
-  if (!conn->cpath_layer) { /* non-rendezvous exit */
+  if (!cpath_layer) { /* non-rendezvous exit */
     tor_assert(circ->package_window > 0);
     circ->package_window--;
   } else { /* we're an AP, or an exit on a rendezvous circ */
-    tor_assert(conn->cpath_layer->package_window > 0);
-    conn->cpath_layer->package_window--;
+    tor_assert(cpath_layer->package_window > 0);
+    cpath_layer->package_window--;
   }
 
   if (--conn->package_window <= 0) { /* is it 0 after decrement? */
     connection_stop_reading(TO_CONN(conn));
     log_debug(domain,"conn->package_window reached 0.");
-    circuit_consider_stop_edge_reading(circ, conn->cpath_layer);
+    circuit_consider_stop_edge_reading(circ, cpath_layer);
     return 0; /* don't process the inbuf any more */
   }
   log_debug(domain,"conn->package_window is now %d",conn->package_window);
@@ -1491,7 +1506,7 @@ connection_edge_consider_sending_sendme(edge_connection_t *conn)
   }
 
   while (conn->deliver_window <= STREAMWINDOW_START - STREAMWINDOW_INCREMENT) {
-    log_debug(conn->cpath_layer?LD_APP:LD_EXIT,
+    log_debug(conn->_base.type == CONN_TYPE_AP ?LD_APP:LD_EXIT,
               "Outbuf %d, Queuing stream sendme.",
               (int)conn->_base.outbuf_flushlen);
     conn->deliver_window += STREAMWINDOW_INCREMENT;
@@ -1693,9 +1708,10 @@ circuit_consider_stop_edge_reading(circuit_t *circ, crypt_path_t *layer_hint)
   if (layer_hint->package_window <= 0) {
     log_debug(domain,"yes, at-origin. stopped.");
     for (conn = TO_ORIGIN_CIRCUIT(circ)->p_streams; conn;
-         conn=conn->next_stream)
+         conn=conn->next_stream) {
       if (conn->cpath_layer == layer_hint)
         connection_stop_reading(TO_CONN(conn));
+    }
     return 1;
   }
   return 0;
diff --git a/src/or/rendclient.c b/src/or/rendclient.c
index 413d9b728..6fe9ba237 100644
--- a/src/or/rendclient.c
+++ b/src/or/rendclient.c
@@ -824,40 +824,42 @@ rend_client_receive_rendezvous(origin_circuit_t *circ, const uint8_t *request,
 void
 rend_client_desc_trynow(const char *query)
 {
-  edge_connection_t *conn;
+  entry_connection_t *conn;
   rend_cache_entry_t *entry;
+  const rend_data_t *rend_data;
   time_t now = time(NULL);
 
   smartlist_t *conns = get_connection_array();
-  SMARTLIST_FOREACH_BEGIN(conns, connection_t *, _conn) {
-    if (_conn->type != CONN_TYPE_AP ||
-        _conn->state != AP_CONN_STATE_RENDDESC_WAIT ||
-        _conn->marked_for_close)
+  SMARTLIST_FOREACH_BEGIN(conns, connection_t *, base_conn) {
+    if (base_conn->type != CONN_TYPE_AP ||
+        base_conn->state != AP_CONN_STATE_RENDDESC_WAIT ||
+        base_conn->marked_for_close)
       continue;
-    conn = TO_EDGE_CONN(_conn);
-    if (!conn->rend_data)
+    conn = TO_ENTRY_CONN(base_conn);
+    rend_data = ENTRY_TO_EDGE_CONN(conn)->rend_data;
+    if (!rend_data)
       continue;
-    if (rend_cmp_service_ids(query, conn->rend_data->onion_address))
+    if (rend_cmp_service_ids(query, rend_data->onion_address))
       continue;
-    assert_connection_ok(TO_CONN(conn), now);
-    if (rend_cache_lookup_entry(conn->rend_data->onion_address, -1,
+    assert_connection_ok(base_conn, now);
+    if (rend_cache_lookup_entry(rend_data->onion_address, -1,
                                 &entry) == 1 &&
         rend_client_any_intro_points_usable(entry)) {
       /* either this fetch worked, or it failed but there was a
        * valid entry from before which we should reuse */
       log_info(LD_REND,"Rend desc is usable. Launching circuits.");
-      conn->_base.state = AP_CONN_STATE_CIRCUIT_WAIT;
+      base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
 
       /* restart their timeout values, so they get a fair shake at
        * connecting to the hidden service. */
-      conn->_base.timestamp_created = now;
-      conn->_base.timestamp_lastread = now;
-      conn->_base.timestamp_lastwritten = now;
+      base_conn->timestamp_created = now;
+      base_conn->timestamp_lastread = now;
+      base_conn->timestamp_lastwritten = now;
 
       if (connection_ap_handshake_attach_circuit(conn) < 0) {
         /* it will never work */
         log_warn(LD_REND,"Rendezvous attempt failed. Closing.");
-        if (!conn->_base.marked_for_close)
+        if (!base_conn->marked_for_close)
           connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
       }
     } else { /* 404, or fetch didn't get that far */
@@ -866,7 +868,7 @@ rend_client_desc_trynow(const char *query)
                  safe_str_client(query));
       connection_mark_unattached_ap(conn, END_STREAM_REASON_RESOLVEFAILED);
     }
-  } SMARTLIST_FOREACH_END(_conn);
+  } SMARTLIST_FOREACH_END(base_conn);
 }
 
 /** Return a newly allocated extend_info_t* for a randomly chosen introduction