Force AES-GCM on mock_services TLS client for hardware crypto

Differential Revision: D112460168

Author: excelle08

packages/feedsim/third_party/src/workloads/ranking/MockServicesClient.cc

@@ -28,6 +28,8 @@
 #include <folly/io/async/AsyncSocket.h>
 #include <folly/io/async/SSLContext.h>
 
+#include <openssl/ssl.h>
+
 #include <thrift/lib/cpp2/async/RocketClientChannel.h>
 #include <thrift/lib/thrift/gen-cpp2/RpcMetadata_types.h>
 
@@ -191,6 +193,17 @@ MockServicesClient::MockServicesClient(
       // pinned fbthrift v2026.01.05.00). Without ALPN, the server may
       // reject the connection or fall back to the header-upgrade path.
       ssl_ctx->setAdvertisedNextProtocols({"rs"});
+      // Restrict the offered ciphers to AES-GCM so the connection negotiates
+      // hardware AES (ARMv8 crypto extensions via libcrypto), matching prod's
+      // cipher. Without this, OpenSSL may pick ChaCha20-Poly1305 (a NEON/integer
+      // cipher with no AES instructions), which reads as ~0% in the crypto
+      // instruction mix vs prod's ~0.88% and runs the AEAD un-accelerated.
+      SSL_CTX_set_ciphersuites(
+          ssl_ctx->getSSLCtx(),
+          "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256"); // TLS 1.3
+      ssl_ctx->setCiphersOrThrow(
+          "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:"
+          "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"); // TLS 1.2
       folly::AsyncSSLSocket::UniquePtr ssl_sock(
           new folly::AsyncSSLSocket(ssl_ctx, evb_));
       // AsyncSSLSocket buffers writes until the TLS handshake completes,