diff --git a/src/common/buffers.c b/src/common/buffers.c
index bade1ce166..f9118dd2f3 100644
--- a/src/common/buffers.c
+++ b/src/common/buffers.c
@@ -551,7 +551,7 @@ read_to_chunk(buf_t *buf, chunk_t *chunk, tor_socket_t fd, size_t at_most,
  */
 /* XXXX indicate "read blocked" somehow? */
 int
-buf_read_from_socket(tor_socket_t s, size_t at_most, buf_t *buf,
+buf_read_from_socket(buf_t *buf, tor_socket_t s, size_t at_most,
                      int *reached_eof,
                      int *socket_error)
 {
@@ -638,7 +638,7 @@ flush_chunk(tor_socket_t s, buf_t *buf, chunk_t *chunk, size_t sz,
  * -1 on failure.  Return 0 if write() would block.
  */
 int
-buf_flush_to_socket(tor_socket_t s, buf_t *buf, size_t sz,
+buf_flush_to_socket(buf_t *buf, tor_socket_t s, size_t sz,
                     size_t *buf_flushlen)
 {
   /* XXXX It's stupid to overload the return values for these functions:
@@ -679,7 +679,7 @@ buf_flush_to_socket(tor_socket_t s, buf_t *buf, size_t sz,
  * Return the new length of the buffer on success, -1 on failure.
  */
 int
-buf_add(const char *string, size_t string_len, buf_t *buf)
+buf_add(buf_t *buf, const char *string, size_t string_len)
 {
   if (!string_len)
     return (int)buf->datalen;
@@ -714,7 +714,7 @@ buf_add(const char *string, size_t string_len, buf_t *buf)
  * onto <b>string</b>.
  */
 void
-buf_peek(char *string, size_t string_len, const buf_t *buf)
+buf_peek(const buf_t *buf, char *string, size_t string_len)
 {
   chunk_t *chunk;
 
@@ -741,7 +741,7 @@ buf_peek(char *string, size_t string_len, const buf_t *buf)
  * must be \<= the number of bytes on the buffer.
  */
 int
-buf_get_bytes(char *string, size_t string_len, buf_t *buf)
+buf_get_bytes(buf_t *buf, char *string, size_t string_len)
 {
   /* There must be string_len bytes in buf; write them onto string,
    * then memmove buf back (that is, remove them from buf).
@@ -749,7 +749,7 @@ buf_get_bytes(char *string, size_t string_len, buf_t *buf)
    * Return the number of bytes still on the buffer. */
 
   check();
-  buf_peek(string, string_len, buf);
+  buf_peek(buf, string, string_len);
   buf_drain(buf, string_len);
   check();
   tor_assert(buf->datalen < INT_MAX);
@@ -783,8 +783,8 @@ buf_move_to_buf(buf_t *buf_out, buf_t *buf_in, size_t *buf_flushlen)
      * it does two copies instead of 1, but I kinda doubt that this will be
      * critical path. */
     size_t n = len > sizeof(b) ? sizeof(b) : len;
-    buf_get_bytes(b, n, buf_in);
-    buf_add(b, n, buf_out);
+    buf_get_bytes(buf_in, b, n);
+    buf_add(buf_out, b, n);
     len -= n;
   }
   *buf_flushlen -= cp;
@@ -911,7 +911,7 @@ buf_peek_startswith(const buf_t *buf, const char *cmd)
     return 0;
   if (buf->datalen < clen)
     return 0;
-  buf_peek(tmp, clen, buf);
+  buf_peek(buf, tmp, clen);
   return fast_memeq(tmp, cmd, clen);
 }
 
@@ -956,7 +956,7 @@ buf_get_line(buf_t *buf, char *data_out, size_t *data_len)
     *data_len = sz + 2;
     return -1;
   }
-  buf_get_bytes(data_out, sz+1, buf);
+  buf_get_bytes(buf, data_out, sz+1);
   data_out[sz+1] = '\0';
   *data_len = sz+1;
   return 1;
diff --git a/src/common/buffers.h b/src/common/buffers.h
index 7666f1895a..0db4f771d6 100644
--- a/src/common/buffers.h
+++ b/src/common/buffers.h
@@ -35,20 +35,20 @@ size_t buf_slack(const buf_t *buf);
 uint32_t buf_get_oldest_chunk_timestamp(const buf_t *buf, uint32_t now);
 size_t buf_get_total_allocation(void);
 
-int buf_read_from_socket(tor_socket_t s, size_t at_most, buf_t *buf,
+int buf_read_from_socket(buf_t *buf, tor_socket_t s, size_t at_most,
                          int *reached_eof,
                          int *socket_error);
 
-int buf_flush_to_socket(tor_socket_t s, buf_t *buf, size_t sz,
+int buf_flush_to_socket(buf_t *buf, tor_socket_t s, size_t sz,
                         size_t *buf_flushlen);
 
-int buf_add(const char *string, size_t string_len, buf_t *buf);
+int buf_add(buf_t *buf, const char *string, size_t string_len);
 int buf_add_compress(buf_t *buf, struct tor_compress_state_t *state,
                           const char *data, size_t data_len, int done);
 int buf_move_to_buf(buf_t *buf_out, buf_t *buf_in, size_t *buf_flushlen);
-void buf_peek(char *string, size_t string_len, const buf_t *buf);
+void buf_peek(const buf_t *buf, char *string, size_t string_len);
 void buf_drain(buf_t *buf, size_t n);
-int buf_get_bytes(char *string, size_t string_len, buf_t *buf);
+int buf_get_bytes(buf_t *buf, char *string, size_t string_len);
 int buf_get_line(buf_t *buf, char *data_out, size_t *data_len);
 
 #define PEEK_BUF_STARTSWITH_MAX 16
diff --git a/src/common/buffers_tls.c b/src/common/buffers_tls.c
index 13c9087db7..8dbd4bcc8e 100644
--- a/src/common/buffers_tls.c
+++ b/src/common/buffers_tls.c
@@ -57,7 +57,7 @@ read_to_chunk_tls(buf_t *buf, chunk_t *chunk, tor_tls_t *tls,
  * ready to write -- or vice versa.
  */
 int
-buf_read_from_tls(tor_tls_t *tls, size_t at_most, buf_t *buf)
+buf_read_from_tls(buf_t *buf, tor_tls_t *tls, size_t at_most)
 {
   int r = 0;
   size_t total_read = 0;
@@ -135,7 +135,7 @@ flush_chunk_tls(tor_tls_t *tls, buf_t *buf, chunk_t *chunk,
  * more than <b>flushlen</b> bytes.
  */
 int
-buf_flush_to_tls(tor_tls_t *tls, buf_t *buf, size_t flushlen,
+buf_flush_to_tls(buf_t *buf, tor_tls_t *tls, size_t flushlen,
               size_t *buf_flushlen)
 {
   int r;
diff --git a/src/common/buffers_tls.h b/src/common/buffers_tls.h
index d6b35fe934..e91dfeba0b 100644
--- a/src/common/buffers_tls.h
+++ b/src/common/buffers_tls.h
@@ -10,10 +10,10 @@
 struct buf_t;
 struct tor_tls_t;
 
-int buf_read_from_tls(struct tor_tls_t *tls, size_t at_most,
-                    struct buf_t *buf);
-int buf_flush_to_tls(struct tor_tls_t *tls, struct buf_t *buf, size_t sz,
-                  size_t *buf_flushlen);
+int buf_read_from_tls(struct buf_t *buf,
+                      struct tor_tls_t *tls, size_t at_most);
+int buf_flush_to_tls(struct buf_t *buf, struct tor_tls_t *tls,
+                     size_t sz, size_t *buf_flushlen);
 
 #endif
 
diff --git a/src/or/connection.c b/src/or/connection.c
index 0a343108d7..86ea999be0 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -3552,7 +3552,7 @@ connection_buf_read_from_socket(connection_t *conn, ssize_t *max_to_read,
 
     initial_size = buf_datalen(conn->inbuf);
     /* else open, or closing */
-    result = buf_read_from_tls(or_conn->tls, at_most, conn->inbuf);
+    result = buf_read_from_tls(conn->inbuf, or_conn->tls, at_most);
     if (TOR_TLS_IS_ERROR(result) || result == TOR_TLS_CLOSE)
       or_conn->tls_error = result;
     else
@@ -3601,7 +3601,7 @@ connection_buf_read_from_socket(connection_t *conn, ssize_t *max_to_read,
       /* If we have any pending bytes, we read them now.  This *can*
        * take us over our read allotment, but really we shouldn't be
        * believing that SSL bytes are the same as TCP bytes anyway. */
-      int r2 = buf_read_from_tls(or_conn->tls, pending, conn->inbuf);
+      int r2 = buf_read_from_tls(conn->inbuf, or_conn->tls, pending);
       if (BUG(r2<0)) {
         log_warn(LD_BUG, "apparently, reading pending bytes can fail.");
         return -1;
@@ -3631,9 +3631,10 @@ connection_buf_read_from_socket(connection_t *conn, ssize_t *max_to_read,
     /* !connection_speaks_cells, !conn->linked_conn. */
     int reached_eof = 0;
     CONN_LOG_PROTECT(conn,
-        result = buf_read_from_socket(conn->s, at_most, conn->inbuf,
-                                      &reached_eof,
-                                      socket_error));
+                     result = buf_read_from_socket(conn->inbuf, conn->s,
+                                                   at_most,
+                                                   &reached_eof,
+                                                   socket_error));
     if (reached_eof)
       conn->inbuf_reached_eof = 1;
 
@@ -3704,7 +3705,7 @@ connection_buf_read_from_socket(connection_t *conn, ssize_t *max_to_read,
 int
 connection_buf_get_bytes(char *string, size_t len, connection_t *conn)
 {
-  return buf_get_bytes(string, len, conn->inbuf);
+  return buf_get_bytes(conn->inbuf, string, len);
 }
 
 /** As buf_get_line(), but read from a connection's input buffer. */
@@ -3860,7 +3861,7 @@ connection_handle_write_impl(connection_t *conn, int force)
 
     /* else open, or closing */
     initial_size = buf_datalen(conn->outbuf);
-    result = buf_flush_to_tls(or_conn->tls, conn->outbuf,
+    result = buf_flush_to_tls(conn->outbuf, or_conn->tls,
                            max_to_write, &conn->outbuf_flushlen);
 
     /* If we just flushed the last bytes, tell the channel on the
@@ -3923,8 +3924,8 @@ connection_handle_write_impl(connection_t *conn, int force)
     result = (int)(initial_size-buf_datalen(conn->outbuf));
   } else {
     CONN_LOG_PROTECT(conn,
-             result = buf_flush_to_socket(conn->s, conn->outbuf,
-                                max_to_write, &conn->outbuf_flushlen));
+                     result = buf_flush_to_socket(conn->outbuf, conn->s,
+                                        max_to_write, &conn->outbuf_flushlen));
     if (result < 0) {
       if (CONN_IS_EDGE(conn))
         connection_edge_end_errno(TO_EDGE_CONN(conn));
@@ -4068,7 +4069,7 @@ connection_write_to_buf_impl_,(const char *string, size_t len,
                                                      dir_conn->compress_state,
                                                      string, len, done));
   } else {
-    CONN_LOG_PROTECT(conn, r = buf_add(string, len, conn->outbuf));
+    CONN_LOG_PROTECT(conn, r = buf_add(conn->outbuf, string, len));
   }
   if (r < 0) {
     if (CONN_IS_EDGE(conn)) {
diff --git a/src/or/main.c b/src/or/main.c
index e9b50763f3..cd726776c4 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -850,12 +850,12 @@ conn_close_if_marked(int i)
                 connection_wants_to_flush(conn));
     } else if (connection_speaks_cells(conn)) {
       if (conn->state == OR_CONN_STATE_OPEN) {
-        retval = buf_flush_to_tls(TO_OR_CONN(conn)->tls, conn->outbuf, sz,
+        retval = buf_flush_to_tls(conn->outbuf, TO_OR_CONN(conn)->tls, sz,
                                &conn->outbuf_flushlen);
       } else
         retval = -1; /* never flush non-open broken tls connections */
     } else {
-      retval = buf_flush_to_socket(conn->s, conn->outbuf, sz,
+      retval = buf_flush_to_socket(conn->outbuf, conn->s, sz,
                                    &conn->outbuf_flushlen);
     }
     if (retval >= 0 && /* Technically, we could survive things like
diff --git a/src/or/proto_cell.c b/src/or/proto_cell.c
index 4ce38ebfc1..4485ab4e9e 100644
--- a/src/or/proto_cell.c
+++ b/src/or/proto_cell.c
@@ -57,7 +57,7 @@ fetch_var_cell_from_buf(buf_t *buf, var_cell_t **out, int linkproto)
   *out = NULL;
   if (buf_datalen(buf) < header_len)
     return 0;
-  buf_peek(hdr, header_len, buf);
+  buf_peek(buf, hdr, header_len);
 
   command = get_uint8(hdr + circ_id_len);
   if (!(cell_command_is_var_length(command, linkproto)))
@@ -74,7 +74,7 @@ fetch_var_cell_from_buf(buf_t *buf, var_cell_t **out, int linkproto)
     result->circ_id = ntohs(get_uint16(hdr));
 
   buf_drain(buf, header_len);
-  buf_peek((char*) result->payload, length, buf);
+  buf_peek(buf, (char*) result->payload, length);
   buf_drain(buf, length);
 
   *out = result;
diff --git a/src/or/proto_control0.c b/src/or/proto_control0.c
index af84786489..c17ba34948 100644
--- a/src/or/proto_control0.c
+++ b/src/or/proto_control0.c
@@ -16,7 +16,7 @@ peek_buf_has_control0_command(buf_t *buf)
   if (buf_datalen(buf) >= 4) {
     char header[4];
     uint16_t cmd;
-    buf_peek(header, sizeof(header), buf);
+    buf_peek(buf, header, sizeof(header));
     cmd = ntohs(get_uint16(header+2));
     if (cmd <= 0x14)
       return 1; /* This is definitely not a v1 control command. */
diff --git a/src/or/proto_ext_or.c b/src/or/proto_ext_or.c
index 70419265d8..057cf109ec 100644
--- a/src/or/proto_ext_or.c
+++ b/src/or/proto_ext_or.c
@@ -26,7 +26,7 @@ fetch_ext_or_command_from_buf(buf_t *buf, ext_or_cmd_t **out)
 
   if (buf_datalen(buf) < EXT_OR_CMD_HEADER_SIZE)
     return 0;
-  buf_peek(hdr, sizeof(hdr), buf);
+  buf_peek(buf, hdr, sizeof(hdr));
   len = ntohs(get_uint16(hdr+2));
   if (buf_datalen(buf) < (unsigned)len + EXT_OR_CMD_HEADER_SIZE)
     return 0;
@@ -34,7 +34,7 @@ fetch_ext_or_command_from_buf(buf_t *buf, ext_or_cmd_t **out)
   (*out)->cmd = ntohs(get_uint16(hdr));
   (*out)->len = len;
   buf_drain(buf, EXT_OR_CMD_HEADER_SIZE);
-  buf_get_bytes((*out)->body, len, buf);
+  buf_get_bytes(buf, (*out)->body, len);
   return 1;
 }
 
diff --git a/src/or/proto_http.c b/src/or/proto_http.c
index 6e03165745..3762429e1e 100644
--- a/src/or/proto_http.c
+++ b/src/or/proto_http.c
@@ -110,14 +110,14 @@ fetch_from_buf_http(buf_t *buf,
   /* all happy. copy into the appropriate places, and return 1 */
   if (headers_out) {
     *headers_out = tor_malloc(headerlen+1);
-    buf_get_bytes(*headers_out, headerlen, buf);
+    buf_get_bytes(buf, *headers_out, headerlen);
     (*headers_out)[headerlen] = 0; /* NUL terminate it */
   }
   if (body_out) {
     tor_assert(body_used);
     *body_used = bodylen;
     *body_out = tor_malloc(bodylen+1);
-    buf_get_bytes(*body_out, bodylen, buf);
+    buf_get_bytes(buf, *body_out, bodylen);
     (*body_out)[bodylen] = 0; /* NUL terminate it */
   }
   return 1;
diff --git a/src/or/relay.c b/src/or/relay.c
index 15ab730a87..e362348bb9 100644
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -2038,7 +2038,7 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
     /* XXXX We could be more efficient here by sometimes packing
      * previously-sent optimistic data in the same cell with data
      * from the inbuf. */
-    buf_get_bytes(payload, length, entry_conn->sending_optimistic_data);
+    buf_get_bytes(entry_conn->sending_optimistic_data, payload, length);
     if (!buf_datalen(entry_conn->sending_optimistic_data)) {
         buf_free(entry_conn->sending_optimistic_data);
         entry_conn->sending_optimistic_data = NULL;
@@ -2056,7 +2056,7 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
        retry */
     if (!entry_conn->pending_optimistic_data)
       entry_conn->pending_optimistic_data = buf_new();
-    buf_add(payload, length, entry_conn->pending_optimistic_data);
+    buf_add(entry_conn->pending_optimistic_data, payload, length);
   }
 
   if (connection_edge_send_command(conn, RELAY_COMMAND_DATA,
diff --git a/src/test/test_buffers.c b/src/test/test_buffers.c
index 44cfedf463..1fd2cd71d8 100644
--- a/src/test/test_buffers.c
+++ b/src/test/test_buffers.c
@@ -45,15 +45,15 @@ test_buffers_basic(void *arg)
   for (j=0;j<256;++j) {
     str[j] = (char)j;
   }
-  buf_add(str, 256, buf);
-  buf_add(str, 256, buf);
+  buf_add(buf, str, 256);
+  buf_add(buf, str, 256);
   tt_int_op(buf_datalen(buf),OP_EQ, 512);
-  buf_get_bytes(str2, 200, buf);
+  buf_get_bytes(buf, str2, 200);
   tt_mem_op(str,OP_EQ, str2, 200);
   tt_int_op(buf_datalen(buf),OP_EQ, 312);
   memset(str2, 0, sizeof(str2));
 
-  buf_get_bytes(str2, 256, buf);
+  buf_get_bytes(buf, str2, 256);
   tt_mem_op(str+200,OP_EQ, str2, 56);
   tt_mem_op(str,OP_EQ, str2+56, 200);
   tt_int_op(buf_datalen(buf),OP_EQ, 56);
@@ -61,16 +61,16 @@ test_buffers_basic(void *arg)
   /* Okay, now we should be 512 bytes into the 4096-byte buffer.  If we add
    * another 3584 bytes, we hit the end. */
   for (j=0;j<15;++j) {
-    buf_add(str, 256, buf);
+    buf_add(buf, str, 256);
   }
   buf_assert_ok(buf);
   tt_int_op(buf_datalen(buf),OP_EQ, 3896);
-  buf_get_bytes(str2, 56, buf);
+  buf_get_bytes(buf, str2, 56);
   tt_int_op(buf_datalen(buf),OP_EQ, 3840);
   tt_mem_op(str+200,OP_EQ, str2, 56);
   for (j=0;j<15;++j) {
     memset(str2, 0, sizeof(str2));
-    buf_get_bytes(str2, 256, buf);
+    buf_get_bytes(buf, str2, 256);
     tt_mem_op(str,OP_EQ, str2, 256);
   }
   tt_int_op(buf_datalen(buf),OP_EQ, 0);
@@ -80,38 +80,38 @@ test_buffers_basic(void *arg)
   /* Okay, now make sure growing can work. */
   buf = buf_new_with_capacity(16);
   //test_eq(buf_capacity(buf), 16);
-  buf_add(str+1, 255, buf);
+  buf_add(buf, str+1, 255);
   //test_eq(buf_capacity(buf), 256);
-  buf_get_bytes(str2, 254, buf);
+  buf_get_bytes(buf, str2, 254);
   tt_mem_op(str+1,OP_EQ, str2, 254);
   //test_eq(buf_capacity(buf), 256);
   buf_assert_ok(buf);
-  buf_add(str, 32, buf);
+  buf_add(buf, str, 32);
   //test_eq(buf_capacity(buf), 256);
   buf_assert_ok(buf);
-  buf_add(str, 256, buf);
+  buf_add(buf, str, 256);
   buf_assert_ok(buf);
   //test_eq(buf_capacity(buf), 512);
   tt_int_op(buf_datalen(buf),OP_EQ, 33+256);
-  buf_get_bytes(str2, 33, buf);
+  buf_get_bytes(buf, str2, 33);
   tt_int_op(*str2,OP_EQ, str[255]);
 
   tt_mem_op(str2+1,OP_EQ, str, 32);
   //test_eq(buf_capacity(buf), 512);
   tt_int_op(buf_datalen(buf),OP_EQ, 256);
-  buf_get_bytes(str2, 256, buf);
+  buf_get_bytes(buf, str2, 256);
   tt_mem_op(str,OP_EQ, str2, 256);
 
   /* now try shrinking: case 1. */
   buf_free(buf);
   buf = buf_new_with_capacity(33668);
   for (j=0;j<67;++j) {
-    buf_add(str,255, buf);
+    buf_add(buf, str,255);
   }
   //test_eq(buf_capacity(buf), 33668);
   tt_int_op(buf_datalen(buf),OP_EQ, 17085);
   for (j=0; j < 40; ++j) {
-    buf_get_bytes(str2, 255,buf);
+    buf_get_bytes(buf, str2, 255);
     tt_mem_op(str2,OP_EQ, str, 255);
   }
 
@@ -119,18 +119,18 @@ test_buffers_basic(void *arg)
   buf_free(buf);
   buf = buf_new_with_capacity(33668);
   for (j=0;j<67;++j) {
-    buf_add(str,255, buf);
+    buf_add(buf, str, 255);
   }
   for (j=0; j < 20; ++j) {
-    buf_get_bytes(str2, 255,buf);
+    buf_get_bytes(buf, str2, 255);
     tt_mem_op(str2,OP_EQ, str, 255);
   }
   for (j=0;j<80;++j) {
-    buf_add(str,255, buf);
+    buf_add(buf, str, 255);
   }
   //test_eq(buf_capacity(buf),33668);
   for (j=0; j < 120; ++j) {
-    buf_get_bytes(str2, 255,buf);
+    buf_get_bytes(buf, str2, 255);
     tt_mem_op(str2,OP_EQ, str, 255);
   }
 
@@ -139,7 +139,7 @@ test_buffers_basic(void *arg)
   buf = buf_new_with_capacity(4096);
   buf2 = buf_new_with_capacity(4096);
   for (j=0;j<100;++j)
-    buf_add(str, 255, buf);
+    buf_add(buf, str, 255);
   tt_int_op(buf_datalen(buf),OP_EQ, 25500);
   for (j=0;j<100;++j) {
     r = 10;
@@ -149,7 +149,7 @@ test_buffers_basic(void *arg)
   tt_int_op(buf_datalen(buf),OP_EQ, 24500);
   tt_int_op(buf_datalen(buf2),OP_EQ, 1000);
   for (j=0;j<3;++j) {
-    buf_get_bytes(str2, 255, buf2);
+    buf_get_bytes(buf2, str2, 255);
     tt_mem_op(str2,OP_EQ, str, 255);
   }
   r = 8192; /*big move*/
@@ -159,7 +159,7 @@ test_buffers_basic(void *arg)
   buf_move_to_buf(buf2, buf, &r);
   tt_int_op(r,OP_EQ, 13692);
   for (j=0;j<97;++j) {
-    buf_get_bytes(str2, 255, buf2);
+    buf_get_bytes(buf2, str2, 255);
     tt_mem_op(str2,OP_EQ, str, 255);
   }
   buf_free(buf);
@@ -169,7 +169,7 @@ test_buffers_basic(void *arg)
   buf = buf_new_with_capacity(5);
   cp = "Testing. This is a moderately long Testing string.";
   for (j = 0; cp[j]; j++)
-    buf_add(cp+j, 1, buf);
+    buf_add(buf, cp+j, 1);
   tt_int_op(0,OP_EQ, buf_find_string_offset(buf, "Testing", 7));
   tt_int_op(1,OP_EQ, buf_find_string_offset(buf, "esting", 6));
   tt_int_op(1,OP_EQ, buf_find_string_offset(buf, "est", 3));
@@ -187,7 +187,7 @@ test_buffers_basic(void *arg)
   {
     char *mem = tor_malloc_zero(65536);
     buf = buf_new();
-    buf_add(mem, 65536, buf);
+    buf_add(buf, mem, 65536);
     tor_free(mem);
 
     tt_int_op(buf_datalen(buf), OP_EQ, 65536);
@@ -233,15 +233,15 @@ test_buffer_pullup(void *arg)
 
   /* Let's add some data. */
   crypto_rand(stuff, 16384);
-  buf_add(stuff, 3000, buf);
-  buf_add(stuff+3000, 3000, buf);
+  buf_add(buf, stuff, 3000);
+  buf_add(buf, stuff+3000, 3000);
   buf_pullup(buf, 0, &cp, &sz);
   tt_ptr_op(cp, OP_NE, NULL);
   tt_int_op(sz, OP_LE, 4096);
 
   /* Make room for 3000 bytes in the first chunk, so that the pullup-move code
    * can get tested. */
-  tt_int_op(buf_get_bytes(tmp, 3000, buf), OP_EQ, 3000);
+  tt_int_op(buf_get_bytes(buf, tmp, 3000), OP_EQ, 3000);
   tt_mem_op(tmp,OP_EQ, stuff, 3000);
   buf_pullup(buf, 2048, &cp, &sz);
   buf_assert_ok(buf);
@@ -249,17 +249,17 @@ test_buffer_pullup(void *arg)
   tt_int_op(sz, OP_GE, 2048);
   tt_mem_op(cp,OP_EQ, stuff+3000, 2048);
   tt_int_op(3000, OP_EQ, buf_datalen(buf));
-  tt_int_op(buf_get_bytes(tmp, 3000, buf), OP_EQ, 0);
+  tt_int_op(buf_get_bytes(buf, tmp, 3000), OP_EQ, 0);
   tt_mem_op(tmp,OP_EQ, stuff+3000, 2048);
 
   buf_free(buf);
 
   /* Now try the large-chunk case. */
   buf = buf_new_with_capacity(3000); /* rounds up to next power of 2. */
-  buf_add(stuff, 4000, buf);
-  buf_add(stuff+4000, 4000, buf);
-  buf_add(stuff+8000, 4000, buf);
-  buf_add(stuff+12000, 4000, buf);
+  buf_add(buf, stuff, 4000);
+  buf_add(buf, stuff+4000, 4000);
+  buf_add(buf, stuff+8000, 4000);
+  buf_add(buf, stuff+12000, 4000);
   tt_int_op(buf_datalen(buf), OP_EQ, 16000);
   buf_pullup(buf, 0, &cp, &sz);
   tt_ptr_op(cp, OP_NE, NULL);
@@ -272,21 +272,21 @@ test_buffer_pullup(void *arg)
   tt_mem_op(cp,OP_EQ, stuff, 12500);
   tt_int_op(buf_datalen(buf), OP_EQ, 16000);
 
-  buf_get_bytes(tmp, 12400, buf);
+  buf_get_bytes(buf, tmp, 12400);
   tt_mem_op(tmp,OP_EQ, stuff, 12400);
   tt_int_op(buf_datalen(buf), OP_EQ, 3600);
-  buf_get_bytes(tmp, 3500, buf);
+  buf_get_bytes(buf, tmp, 3500);
   tt_mem_op(tmp,OP_EQ, stuff+12400, 3500);
-  buf_get_bytes(tmp, 100, buf);
+  buf_get_bytes(buf, tmp, 100);
   tt_mem_op(tmp,OP_EQ, stuff+15900, 10);
 
   buf_free(buf);
 
   /* Make sure that the pull-up-whole-buffer case works */
   buf = buf_new_with_capacity(3000); /* rounds up to next power of 2. */
-  buf_add(stuff, 4000, buf);
-  buf_add(stuff+4000, 4000, buf);
-  buf_get_bytes(tmp, 100, buf); /* dump 100 bytes from first chunk */
+  buf_add(buf, stuff, 4000);
+  buf_add(buf, stuff+4000, 4000);
+  buf_get_bytes(buf, tmp, 100); /* dump 100 bytes from first chunk */
   buf_pullup(buf, 16000, &cp, &sz);
   buf_assert_ok(buf);
   tt_ptr_op(cp, OP_NE, NULL);
@@ -324,23 +324,23 @@ test_buffer_copy(void *arg)
   /* Now try with a short buffer. */
   s = "And now comes an act of enormous enormance!";
   len = strlen(s);
-  buf_add(s, len, buf);
+  buf_add(buf, s, len);
   tt_int_op(len, OP_EQ, buf_datalen(buf));
   /* Add junk to buf2 so we can test replacing.*/
-  buf_add("BLARG", 5, buf2);
+  buf_add(buf2, "BLARG", 5);
   tt_int_op(0, OP_EQ, buf_set_to_copy(&buf2, buf));
   tt_int_op(len, OP_EQ, buf_datalen(buf2));
-  buf_get_bytes(b, len, buf2);
+  buf_get_bytes(buf2, b, len);
   tt_mem_op(b, OP_EQ, s, len);
   /* Now free buf2 and retry so we can test allocating */
   buf_free(buf2);
   buf2 = NULL;
   tt_int_op(0, OP_EQ, buf_set_to_copy(&buf2, buf));
   tt_int_op(len, OP_EQ, buf_datalen(buf2));
-  buf_get_bytes(b, len, buf2);
+  buf_get_bytes(buf2, b, len);
   tt_mem_op(b, OP_EQ, s, len);
   /* Clear buf for next test */
-  buf_get_bytes(b, len, buf);
+  buf_get_bytes(buf, b, len);
   tt_int_op(buf_datalen(buf),OP_EQ,0);
 
   /* Okay, now let's try a bigger buffer. */
@@ -350,13 +350,13 @@ test_buffer_copy(void *arg)
   len = strlen(s);
   for (i = 0; i < 256; ++i) {
     b[0]=i;
-    buf_add(b, 1, buf);
-    buf_add(s, len, buf);
+    buf_add(buf, b, 1);
+    buf_add(buf, s, len);
   }
   tt_int_op(0, OP_EQ, buf_set_to_copy(&buf2, buf));
   tt_int_op(buf_datalen(buf2), OP_EQ, buf_datalen(buf));
   for (i = 0; i < 256; ++i) {
-    buf_get_bytes(b, len+1, buf2);
+    buf_get_bytes(buf2, b, len+1);
     tt_int_op((unsigned char)b[0],OP_EQ,i);
     tt_mem_op(b+1, OP_EQ, s, len);
   }
@@ -381,13 +381,13 @@ test_buffer_ext_or_cmd(void *arg)
   tt_ptr_op(NULL, OP_EQ, cmd);
 
   /* Three bytes: shouldn't work. */
-  buf_add("\x00\x20\x00", 3, buf);
+  buf_add(buf, "\x00\x20\x00", 3);
   tt_int_op(0, OP_EQ, fetch_ext_or_command_from_buf(buf, &cmd));
   tt_ptr_op(NULL, OP_EQ, cmd);
   tt_int_op(3, OP_EQ, buf_datalen(buf));
 
   /* 0020 0000: That's a nil command. It should work. */
-  buf_add("\x00", 1, buf);
+  buf_add(buf, "\x00", 1);
   tt_int_op(1, OP_EQ, fetch_ext_or_command_from_buf(buf, &cmd));
   tt_ptr_op(NULL, OP_NE, cmd);
   tt_int_op(0x20, OP_EQ, cmd->cmd);
@@ -397,10 +397,10 @@ test_buffer_ext_or_cmd(void *arg)
   cmd = NULL;
 
   /* Now try a length-6 command with one byte missing. */
-  buf_add("\x10\x21\x00\x06""abcde", 9, buf);
+  buf_add(buf, "\x10\x21\x00\x06""abcde", 9);
   tt_int_op(0, OP_EQ, fetch_ext_or_command_from_buf(buf, &cmd));
   tt_ptr_op(NULL, OP_EQ, cmd);
-  buf_add("f", 1, buf);
+  buf_add(buf, "f", 1);
   tt_int_op(1, OP_EQ, fetch_ext_or_command_from_buf(buf, &cmd));
   tt_ptr_op(NULL, OP_NE, cmd);
   tt_int_op(0x1021, OP_EQ, cmd->cmd);
@@ -411,7 +411,7 @@ test_buffer_ext_or_cmd(void *arg)
   cmd = NULL;
 
   /* Now try a length-10 command with 4 extra bytes. */
-  buf_add("\xff\xff\x00\x0aloremipsum\x10\x00\xff\xff", 18, buf);
+  buf_add(buf, "\xff\xff\x00\x0aloremipsum\x10\x00\xff\xff", 18);
   tt_int_op(1, OP_EQ, fetch_ext_or_command_from_buf(buf, &cmd));
   tt_ptr_op(NULL, OP_NE, cmd);
   tt_int_op(0xffff, OP_EQ, cmd->cmd);
@@ -425,7 +425,7 @@ test_buffer_ext_or_cmd(void *arg)
    * waiting. */
   tt_int_op(0, OP_EQ, fetch_ext_or_command_from_buf(buf, &cmd));
   tmp = tor_malloc_zero(65535);
-  buf_add(tmp, 65535, buf);
+  buf_add(buf, tmp, 65535);
   tt_int_op(1, OP_EQ, fetch_ext_or_command_from_buf(buf, &cmd));
   tt_ptr_op(NULL, OP_NE, cmd);
   tt_int_op(0x1000, OP_EQ, cmd->cmd);
@@ -461,36 +461,36 @@ test_buffer_allocation_tracking(void *arg)
   tt_int_op(buf_allocation(buf1), OP_EQ, 0);
   tt_int_op(buf_get_total_allocation(), OP_EQ, 0);
 
-  buf_add(junk, 4000, buf1);
-  buf_add(junk, 4000, buf1);
-  buf_add(junk, 4000, buf1);
-  buf_add(junk, 4000, buf1);
+  buf_add(buf1, junk, 4000);
+  buf_add(buf1, junk, 4000);
+  buf_add(buf1, junk, 4000);
+  buf_add(buf1, junk, 4000);
   tt_int_op(buf_allocation(buf1), OP_EQ, 16384);
-  buf_get_bytes(junk, 100, buf1);
+  buf_get_bytes(buf1, junk, 100);
   tt_int_op(buf_allocation(buf1), OP_EQ, 16384); /* still 4 4k chunks */
 
   tt_int_op(buf_get_total_allocation(), OP_EQ, 16384);
 
-  buf_get_bytes(junk, 4096, buf1); /* drop a 1k chunk... */
+  buf_get_bytes(buf1, junk, 4096); /* drop a 1k chunk... */
   tt_int_op(buf_allocation(buf1), OP_EQ, 3*4096); /* now 3 4k chunks */
 
   tt_int_op(buf_get_total_allocation(), OP_EQ, 12288); /* that chunk was really
                                                        freed. */
 
-  buf_add(junk, 4000, buf2);
+  buf_add(buf2, junk, 4000);
   tt_int_op(buf_allocation(buf2), OP_EQ, 4096); /* another 4k chunk. */
   /*
    * We bounce back up to 16384 by allocating a new chunk.
    */
   tt_int_op(buf_get_total_allocation(), OP_EQ, 16384);
-  buf_add(junk, 4000, buf2);
+  buf_add(buf2, junk, 4000);
   tt_int_op(buf_allocation(buf2), OP_EQ, 8192); /* another 4k chunk. */
   tt_int_op(buf_get_total_allocation(),
             OP_EQ, 5*4096); /* that chunk was new. */
 
   /* Make a really huge buffer */
   for (i = 0; i < 1000; ++i) {
-    buf_add(junk, 4000, buf2);
+    buf_add(buf2, junk, 4000);
   }
   tt_int_op(buf_allocation(buf2), OP_GE, 4008000);
   tt_int_op(buf_get_total_allocation(), OP_GE, 4008000);
@@ -533,7 +533,7 @@ test_buffer_time_tracking(void *arg)
   tt_int_op(0, OP_EQ, buf_get_oldest_chunk_timestamp(buf, START_MSEC));
   tt_int_op(0, OP_EQ, buf_get_oldest_chunk_timestamp(buf, START_MSEC+1000));
 
-  buf_add("ABCDEFG", 7, buf);
+  buf_add(buf, "ABCDEFG", 7);
   tt_int_op(1000, OP_EQ, buf_get_oldest_chunk_timestamp(buf, START_MSEC+1000));
 
   buf2 = buf_copy(buf);
@@ -544,7 +544,7 @@ test_buffer_time_tracking(void *arg)
   /* Now add more bytes; enough to overflow the first chunk. */
   monotime_coarse_set_mock_time_nsec(START_NSEC + 123 * (uint64_t)1000000);
   for (i = 0; i < 600; ++i)
-    buf_add("ABCDEFG", 7, buf);
+    buf_add(buf, "ABCDEFG", 7);
   tt_int_op(4207, OP_EQ, buf_datalen(buf));
 
   /* The oldest bytes are still in the front. */
@@ -552,12 +552,12 @@ test_buffer_time_tracking(void *arg)
 
   /* Once those bytes are dropped, the chunk is still on the first
    * timestamp. */
-  buf_get_bytes(tmp, 100, buf);
+  buf_get_bytes(buf, tmp, 100);
   tt_int_op(2000, OP_EQ, buf_get_oldest_chunk_timestamp(buf, START_MSEC+2000));
 
   /* But once we discard the whole first chunk, we get the data in the second
    * chunk. */
-  buf_get_bytes(tmp, 4000, buf);
+  buf_get_bytes(buf, tmp, 4000);
   tt_int_op(107, OP_EQ, buf_datalen(buf));
   tt_int_op(2000, OP_EQ, buf_get_oldest_chunk_timestamp(buf, START_MSEC+2123));
 
@@ -565,12 +565,12 @@ test_buffer_time_tracking(void *arg)
      its time gets updated */
   monotime_coarse_set_mock_time_nsec(START_NSEC + 5617 * (uint64_t)1000000);
   for (i = 0; i < 600; ++i)
-    buf_add("ABCDEFG", 7, buf);
+    buf_add(buf, "ABCDEFG", 7);
   tt_int_op(4307, OP_EQ, buf_datalen(buf));
 
   tt_int_op(2000, OP_EQ, buf_get_oldest_chunk_timestamp(buf, START_MSEC+2123));
-  buf_get_bytes(tmp, 4000, buf);
-  buf_get_bytes(tmp, 306, buf);
+  buf_get_bytes(buf, tmp, 4000);
+  buf_get_bytes(buf, tmp, 306);
   tt_int_op(0, OP_EQ, buf_get_oldest_chunk_timestamp(buf, START_MSEC+5617));
   tt_int_op(383, OP_EQ, buf_get_oldest_chunk_timestamp(buf, START_MSEC+6000));
 
@@ -596,13 +596,13 @@ test_buffers_compress_fin_at_chunk_end_impl(compress_method_t method,
   sz = buf_get_default_chunk_size(buf);
   msg = tor_malloc_zero(sz);
 
-  buf_add(msg, 1, buf);
+  buf_add(buf, msg, 1);
   tt_assert(buf->head);
 
   /* Fill up the chunk so the compression stuff won't fit in one chunk. */
   tt_uint_op(buf->head->memlen, OP_LT, sz);
   headerjunk = buf->head->memlen - 7;
-  buf_add(msg, headerjunk-1, buf);
+  buf_add(buf, msg, headerjunk-1);
   tt_uint_op(buf->head->datalen, OP_EQ, headerjunk);
   tt_uint_op(buf_datalen(buf), OP_EQ, headerjunk);
   /* Write an empty string, with finalization on. */
@@ -612,7 +612,7 @@ test_buffers_compress_fin_at_chunk_end_impl(compress_method_t method,
   in_len = buf_datalen(buf);
   contents = tor_malloc(in_len);
 
-  tt_int_op(buf_get_bytes(contents, in_len, buf), OP_EQ, 0);
+  tt_int_op(buf_get_bytes(buf, contents, in_len), OP_EQ, 0);
 
   if (method == NO_METHOD) {
     tt_uint_op(in_len, OP_EQ, headerjunk);
@@ -671,7 +671,7 @@ test_buffers_compress_impl(compress_method_t method,
   in_len = buf_datalen(buf);
   contents = tor_malloc(in_len);
 
-  tt_int_op(buf_get_bytes(contents, in_len, buf), OP_EQ, 0);
+  tt_int_op(buf_get_bytes(buf, contents, in_len), OP_EQ, 0);
 
   tt_int_op(0, OP_EQ, tor_uncompress(&expanded, &out_len,
                                      contents, in_len,
@@ -765,11 +765,11 @@ test_buffers_tls_read_mocked(void *arg)
   buf = buf_new();
 
   next_reply_val[0] = 1024;
-  tt_int_op(128, OP_EQ, buf_read_from_tls(NULL, 128, buf));
+  tt_int_op(128, OP_EQ, buf_read_from_tls(buf, NULL, 128));
 
   next_reply_val[0] = 5000;
   next_reply_val[1] = 5000;
-  tt_int_op(6000, OP_EQ, buf_read_from_tls(NULL, 6000, buf));
+  tt_int_op(6000, OP_EQ, buf_read_from_tls(buf, NULL, 6000));
 
  done:
   UNMOCK(tor_tls_read);
@@ -852,7 +852,7 @@ test_buffer_peek_startswith(void *arg)
   tt_assert(buf_peek_startswith(buf, ""));
   tt_assert(! buf_peek_startswith(buf, "X"));
 
-  buf_add("Tor", 3, buf);
+  buf_add(buf, "Tor", 3);
 
   tt_assert(buf_peek_startswith(buf, ""));
   tt_assert(buf_peek_startswith(buf, "T"));
diff --git a/src/test/test_extorport.c b/src/test/test_extorport.c
index f8ee94c3ac..9e8721ee36 100644
--- a/src/test/test_extorport.c
+++ b/src/test/test_extorport.c
@@ -78,7 +78,7 @@ connection_write_to_buf_impl_replacement(const char *string, size_t len,
 
   tor_assert(string);
   tor_assert(conn);
-  buf_add(string, len, conn->outbuf);
+  buf_add(conn->outbuf, string, len);
 }
 
 static char *
@@ -89,7 +89,7 @@ buf_get_contents(buf_t *buf, size_t *sz_out)
   if (*sz_out >= ULONG_MAX)
     return NULL; /* C'mon, really? */
   out = tor_malloc(*sz_out + 1);
-  if (buf_get_bytes(out, (unsigned long)*sz_out, buf) != 0) {
+  if (buf_get_bytes(buf, out, (unsigned long)*sz_out) != 0) {
     tor_free(out);
     return NULL;
   }
@@ -399,14 +399,14 @@ handshake_start(or_connection_t *conn, int receiving)
 
 #define WRITE(s,n)                                                      \
   do {                                                                  \
-    buf_add((s), (n), TO_CONN(conn)->inbuf);                       \
+    buf_add(TO_CONN(conn)->inbuf, (s), (n));                           \
   } while (0)
 #define CONTAINS(s,n)                                           \
   do {                                                          \
     tt_int_op((n), OP_LE, sizeof(b));                              \
     tt_int_op(buf_datalen(TO_CONN(conn)->outbuf), OP_EQ, (n));     \
     if ((n)) {                                                  \
-      buf_get_bytes(b, (n), TO_CONN(conn)->outbuf);            \
+      buf_get_bytes(TO_CONN(conn)->outbuf, b, (n));                \
       tt_mem_op(b, OP_EQ, (s), (n));                               \
     }                                                           \
   } while (0)
diff --git a/src/test/test_helpers.c b/src/test/test_helpers.c
index 997f247378..0da9cf64d0 100644
--- a/src/test/test_helpers.c
+++ b/src/test/test_helpers.c
@@ -114,7 +114,7 @@ connection_write_to_buf_mock(const char *string, size_t len,
   tor_assert(string);
   tor_assert(conn);
 
-  buf_add(string, len, conn->outbuf);
+  buf_add(conn->outbuf, string, len);
 }
 
 /* Set up a fake origin circuit with the specified number of cells,
diff --git a/src/test/test_oom.c b/src/test/test_oom.c
index 2391a30520..cf28690a28 100644
--- a/src/test/test_oom.c
+++ b/src/test/test_oom.c
@@ -67,7 +67,7 @@ add_bytes_to_buf(buf_t *buf, size_t n_bytes)
   while (n_bytes) {
     size_t this_add = n_bytes > sizeof(b) ? sizeof(b) : n_bytes;
     crypto_rand(b, this_add);
-    buf_add(b, this_add, buf);
+    buf_add(buf, b, this_add);
     n_bytes -= this_add;
   }
 }
diff --git a/src/test/test_socks.c b/src/test/test_socks.c
index 0791db9a18..6dc8215a95 100644
--- a/src/test/test_socks.c
+++ b/src/test/test_socks.c
@@ -44,7 +44,7 @@ static const struct testcase_setup_t socks_setup = {
   buf_t *buf = testdata->buf;                   \
   socks_request_t *socks = testdata->req;
 #define ADD_DATA(buf, s)                                        \
-  buf_add(s, sizeof(s)-1, buf)
+  buf_add(buf, s, sizeof(s)-1)
 
 static void
 socks_request_clear(socks_request_t *socks)