Skip to content

CLOUDFLARE

Read original ↗

We're open sourcing our privacy proxy CLI

Summary

Cloudflare open-sources pvcli (github.com/cloudflareresearch/pvcli), a Rust CLI tool that consolidates debugging of privacy-preserving protocols — starting with Oblivious HTTP (OHTTP) — into a single curl-like interface. The tool was born from operational pain: debugging OHTTP at the scale of millions of requests per second required manual binary-parsing of HPKE-encrypted payloads, hand-encoding Binary HTTP (RFC 9292), and stitching together bespoke per-customer scripts. pvcli replaces all of that with one command that handles key-fetching, binary-encoding, encryption, relay/gateway routing, and verbose step-by-step logging.

Key Takeaways

  1. OHTTP debugging is an 8-step multi-party problem. The protocol involves four parties (client, relay, gateway, target) and 8 sequential steps — any of which can fail. Before pvcli, debugging a single OHTTP request required manually parsing binary key configs, hand-encoding Binary HTTP, and crafting encryption scripts — "painstakingly going through raw bits" was the norm.

  2. Binary HTTP (RFC 9292) is a length-prefixed binary encoding of HTTP. The raw format encodes method, scheme, host, path, headers, and body as prefixed byte sequences — e.g. 02 = indeterminate-length request, 04504f5354 = POST. A single misplaced byte (an extra 0x20 space character) can cause subtle, hard-to-diagnose failures that look like remote bugs but are local encoding errors.

  3. OHTTP Key Configuration (RFC 9458 §3) is a binary-encoded structure containing key ID, KEM algorithm, public key bytes, and symmetric algorithm identifiers. Manual parsing requires cross-referencing the RFC to decode: 0029 = 41-byte entry, 55 = key ID, 0020 = DHKEM(X25519, HKDF-SHA256), etc.

  4. The tool handles all protocol steps automatically. A single pvcli --ohttp --first-hop <relay> --proxy <gateway> <target> command: fetches the public key from the gateway, encrypts the request, constructs the wrapper HTTP request, sends it through the relay, receives the encrypted response, and decrypts it — with -vvv showing every intermediate step.

  5. curl-inspired "principle of least surprise" design. Arguments mirror curl conventions (-X POST, --header, --data, -v), reducing the learning curve. Additional protocol-specific flags (--first-hop, --proxy, --first-hop-header, --first-hop-client/--first-hop-key for mTLS) extend the familiar interface to the multi-party OHTTP topology.

  6. Built for multiple privacy protocols, not just OHTTP. The tool already supports CONNECT proxying and HTTP/3; planned additions include MASQUE (TCP over HTTP/3, UDP/IP over HTTP/2 and HTTP/3), Privacy Pass, post-quantum cryptography, chunked OHTTP, and timing/latency instrumentation.

  7. Operational context: Cloudflare's Privacy team operates at scale. The team powers Apple's iCloud Private Relay, Microsoft's Edge Secure Network VPN, Flo Health's Anonymous Mode, and other privacy products — handling millions of requests per second. Customer-specific debugging requirements and the multi-party architecture drove the tool's creation.

  8. The tool doubles as a live-system test harness. Customers can use pvcli to run end-to-end tests against their own OHTTP deployments without writing custom clients — the command from the post is directly executable against Cloudflare's public relay/gateway demo at ohttp.info.

Operational Numbers

  • Scale of Cloudflare's privacy-protocol operations: millions of requests per second
  • Products powered: iCloud Private Relay, Microsoft Edge Secure Network VPN, Flo Health Anonymous Mode, others
  • Protocol parties: 4 (client, relay, gateway, target)
  • Protocol steps: 8 (key fetch, encrypt, send-to-relay, relay-forwards, gateway-decrypts, target-processes, gateway-encrypts-response, client-decrypts)

Caveats

  • The post is primarily a tooling announcement; no new architectural disclosures about Cloudflare's production OHTTP infrastructure beyond what was previously known.
  • No production metrics (latency, error rates, debugging time savings) are disclosed.
  • MASQUE and Privacy Pass support are roadmap, not shipped.
  • The tool is open-source under Apache 2.0 and accepting contributions.

Source

Last updated · 598 distilled / 1,814 read