JA EN
shiichan

Goodbye OHTTP debugging headaches! Cloudflare open-sources its privacy proxy CLI, pvcli

Cloudflare Blog ★★★★ View Markdown
#cloudflare#security#devops

Hey everyone, it's me! Today's news should land well with anyone working on privacy protocols — a bit niche, but a genuinely handy tool just got released.

Cloudflare Blog blog.cloudflare.com

What was announced?

According to Cloudflare's blog, Cloudflare has open-sourced a new command-line tool called pvcli under the Apache-2.0 license. It's a curl-like tool built to simplify testing complex privacy protocols such as OHTTP (Oblivious HTTP).

The story so far

While building products like Privacy Proxy and Privacy Gateway, Cloudflare's privacy team ran into the fact that debugging protocols like OHTTP is complex and time-consuming. Because OHTTP is designed so no single party can know both "who" is making a request and "what" it contains, debugging meant tracing interactions across multiple parties — the client, relay, and gateway — often down at the binary level.

In practice, that meant manually parsing long hex-encoded binary strings, cross-referencing RFC 9458 and RFC 9292 field by field. And when something went wrong, errors like "malformed request" didn't give much to go on, so tracking down the actual cause took a while.

What changes

With pvcli, tasks like binary HTTP (BHTTP) encoding, public-key encryption, and routing correctly across multiple parties all run behind a single command. Its logging shows each step along the way, making it easier to spot exactly where a request went wrong. That should be a real time-saver for people implementing OHTTP or debugging privacy protocols in general.

Dive Deep

You can install it via Rust's cargo:

curl https://sh.rustup.rs -sSf | sh
cargo install --git https://github.com/cloudflareresearch/pvcli

Here's what a basic OHTTP request looks like:

pvcli --ohttp \
   --first-hop https://relay-cloudflare.ohttp.info \
   --proxy https://gateway.ohttp.info \
   -X POST \
   --header "content-type: application/json" \
   --data '{"test":1}' \
   https://target.ohttp.info/anything

A few other features worth knowing about:

  • -v and -vvv step up the verbosity of the logs
  • --first-hop-header lets you set headers destined for the relay
  • --first-hop-client and --first-hop-key support mTLS client certificate authentication
  • --http3 enables HTTP/3

Looking ahead, Cloudflare is planning MASQUE support (proxying TCP/UDP/IP), post-quantum cryptography, chunked OHTTP, and better timing-information display. If you're already comfortable with curl, the argument style should feel familiar — it's designed around the principle of least surprise.

Wrap-up

Here's a recap.

  • Cloudflare open-sourced pvcli, a CLI for complex privacy protocols like OHTTP, under Apache-2.0
  • Debugging used to mean manually parsing hex-encoded binary data
  • pvcli handles BHTTP encoding, encryption, and routing behind a single command
  • It supports verbose logging, mTLS, and HTTP/3
  • MASQUE and post-quantum crypto support are planned next

If you're implementing or testing OHTTP or similar privacy protocols, this looks worth trying out.

Related posts