Enable TLS-over-Rocket on mock_services with ALPN rs

Summary:
Closes the −9.9pp `RPC-AsyncIO` and −3.3pp `Encryption` CPU gaps observed in t31v5 BGM (vs prod `multifeed/aggregator_main`). The prior attempt in this stack omitted TLS because `folly::AsyncSSLSocket` + `RocketClientChannel::newChannel(...)` was failing the probe RPC with timeout; root cause was missing ALPN `"rs"` advertisement (required by ThriftServer with `setSSLPolicy::REQUIRED` to route the connection into the Rocket transport — without it, the server rejects the Rocket setup frame because the TLS-layer protocol selection picked the wrong path). This change adds the missing ALPN bits on both sides and matches the canonical pattern at `thrift/lib/cpp2/test/server/ThriftServerTest.cpp` `RocketOverSSLNoALPN` in the pinned fbthrift v2026.01.05.00.

Server (`MockServiceMain.cc`):
- New `--tls_cert` / `--tls_key` gflags. When both set, build a `wangle::SSLContextConfig`, set the cert/key, set `clientVerification = DO_NOT_REQUEST` (no peer cert needed), and **call `setNextProtocols({"rs"})`** so the server advertises Rocket-over-TLS via ALPN.
- `server->setSSLConfig(sslCfg)` + `server->setSSLPolicy(REQUIRED)`.

Client (`MockServicesClient.cc`):
- Read `MOCK_TLS` env var (LeafNodeRank uses gengetopt for CLI, rejects unknown flags, so env-var is the only viable injection path).
- When set: build a `folly::SSLContext` with `authenticate(false, false)` + `setVerificationOption(NO_VERIFY)` (self-signed cert) + **`setAdvertisedNextProtocols({"rs"})`**.
- Construct `folly::AsyncSSLSocket::UniquePtr` from that context, call `ssl_sock->connect(nullptr, addr)`, then `socket = std::move(ssl_sock)` so the UniquePtr conversion to `AsyncSocket::UniquePtr` preserves the SSL type. Hand to `RocketClientChannel::newChannel(...)`. AsyncSSLSocket buffers writes until the TLS handshake completes, so Rocket's setup frame goes out only after TLS is up.

Shell-script plumbing:
- `run-feedsim-multi.sh`: when `FEEDSIM_TLS=1`, pass `--tls_cert=${FEEDSIM_ROOT}/certs/example.crt --tls_key=...` to each mock_services instance. Fail fast if certs are missing.
- `run.sh`: when `FEEDSIM_TLS=1`, export `MOCK_TLS=1` so LeafNodeRank's child env inherits it.

Cert plumbing was already in place from the prior diff in this stack (install_feedsim.sh extracts `packages/common/certs.tar.gz` with `--strip-components=1` to `${FEEDSIM_ROOT}/certs/example.{crt,key}`).

Reviewed By: YifanYuan3

Differential Revision: D107327606

Author: excelle08

packages/feedsim/run-feedsim-multi.sh

@@ -164,7 +164,21 @@ function start_mock_services() {
     local offset_us="${MOCK_LATENCY_OFFSET_US:-0}"
     local skip_us="${MOCK_LATENCY_SKIP_THRESHOLD_US:-100}"
 
-    echo "Starting mock_services on port ${port} (cores=${core_range}, io_threads=${io_threads}, cap_us=${cap_us}, offset_us=${offset_us}, skip_us=${skip_us}, silesia=${SILESIA_DIR_ABS})"
+    # TLS opt-in: FEEDSIM_TLS=1 enables TLS on both server and client.
+    # Server reads --tls_cert / --tls_key; client picks up MOCK_TLS env var
+    # (LeafNodeRank uses gengetopt and rejects unknown CLI flags).
+    local tls_opts=""
+    if [ "${FEEDSIM_TLS:-0}" = "1" ]; then
+        local cert_dir="${FEEDSIM_ROOT}/certs"
+        if [ ! -r "${cert_dir}/example.crt" ] || [ ! -r "${cert_dir}/example.key" ]; then
+            echo "ERROR: FEEDSIM_TLS=1 but ${cert_dir}/example.{crt,key} not found" >&2
+            exit 1
+        fi
+        tls_opts="--tls_cert=${cert_dir}/example.crt --tls_key=${cert_dir}/example.key"
+    fi
+
+    echo "Starting mock_services on port ${port} (cores=${core_range}, io_threads=${io_threads}, cap_us=${cap_us}, offset_us=${offset_us}, skip_us=${skip_us}, tls=${FEEDSIM_TLS:-0}, silesia=${SILESIA_DIR_ABS})"
+    # shellcheck disable=SC2086
     taskset --cpu-list "$core_range" \
         "$MOCK_SERVICES_BIN" \
         --port="$port" \
@@ -173,6 +187,7 @@ function start_mock_services() {
         --latency_offset_us="$offset_us" \
         --latency_skip_threshold_us="$skip_us" \
         --silesia_dir="$SILESIA_DIR_ABS" \
+        $tls_opts \
         > "$log_path" 2>&1 &
     local pid=$!
     MOCK_SERVICES_PIDS+=("$pid")

packages/feedsim/run.sh

@@ -729,12 +729,16 @@ main() {
         mock_services_opts="$mock_services_opts --mock_keepalive_interval_ms=${MOCK_KEEPALIVE_INTERVAL_MS}"
         echo "MockServicesClient keepalive: ENABLED (interval=${MOCK_KEEPALIVE_INTERVAL_MS} ms)"
     fi
-    # Wire compression on the outbound MockServicesClient channel.
-    # LeafNodeRank uses gengetopt (rejects unknown flags), so the knob is
-    # plumbed via the MOCK_COMPRESS_ZSTD env var read inside
-    # MockServicesClient.cc — not as a CLI flag. FEEDSIM_NO_RPC_ZSTD=1 turns
-    # ZSTD off (binary default is on); leave unset for default-on parity with
-    # prod's wire-compressed channels.
+    # TLS + wire compression on the outbound MockServicesClient channel.
+    # LeafNodeRank uses gengetopt (rejects unknown CLI flags), so these knobs
+    # are plumbed via env vars MOCK_TLS / MOCK_COMPRESS_ZSTD read inside
+    # MockServicesClient.cc. FEEDSIM_TLS=1 must match the server-side
+    # --tls_cert/--tls_key wiring in run-feedsim-multi.sh. FEEDSIM_NO_RPC_ZSTD=1
+    # disables ZSTD (binary default is on); leave unset for prod-parity.
+    if [ "${FEEDSIM_TLS:-0}" = "1" ]; then
+        export MOCK_TLS=1
+        echo "MockServicesClient TLS: ENABLED (via MOCK_TLS env)"
+    fi
     if [ "${FEEDSIM_NO_RPC_ZSTD:-0}" = "1" ]; then
         export MOCK_COMPRESS_ZSTD=0
         echo "MockServicesClient ZSTD: DISABLED (via MOCK_COMPRESS_ZSTD env)"

packages/feedsim/third_party/src/workloads/ranking/MockServicesClient.cc

@@ -24,7 +24,9 @@
 #include <cstring>
 
 #include <folly/SocketAddress.h>
+#include <folly/io/async/AsyncSSLSocket.h>
 #include <folly/io/async/AsyncSocket.h>
+#include <folly/io/async/SSLContext.h>
 
 #include <thrift/lib/cpp2/async/RocketClientChannel.h>
 #include <thrift/lib/thrift/gen-cpp2/RpcMetadata_types.h>
@@ -33,8 +35,10 @@
 
 namespace {
 // LeafNodeRank uses gengetopt (not gflags) for CLI parsing, so we cannot add
-// CLI flags here. Read knobs from env vars instead. Set MOCK_COMPRESS_ZSTD=0
-// to disable per-channel ZSTD negotiation (default on).
+// CLI flags here. Read knobs from env vars instead. Set MOCK_TLS=1 to use
+// AsyncSSLSocket (with ALPN "rs" so the server routes the connection into
+// the Rocket transport). Set MOCK_COMPRESS_ZSTD=0 to disable per-channel
+// ZSTD negotiation (default on).
 bool envBoolTrue(const char* name, bool default_value) {
   const char* v = std::getenv(name);
   if (v == nullptr) {
@@ -118,11 +122,33 @@ MockServicesClient::MockServicesClient(
   // RocketClientChannel must be created on the EventBase thread. Use
   // runInEventBaseThreadAndWait so this constructor remains usable from
   // any thread (typically the main thread during ThreadStartup).
+  const bool use_tls = envBoolTrue("MOCK_TLS", false);
   const bool use_zstd = envBoolTrue("MOCK_COMPRESS_ZSTD", true);
-  evb_->runInEventBaseThreadAndWait([this, &host, port, use_zstd]() {
+  evb_->runInEventBaseThreadAndWait([this, &host, port, use_tls, use_zstd]() {
     folly::SocketAddress addr(host, port, /*allowNameLookup=*/true);
-    folly::AsyncSocket::UniquePtr socket(
-        new folly::AsyncSocket(evb_, addr));
+    folly::AsyncSocket::UniquePtr socket;
+    if (use_tls) {
+      auto ssl_ctx = std::make_shared<folly::SSLContext>();
+      // Benchmark-only: skip peer cert verification so example certs work.
+      ssl_ctx->authenticate(/*checkPeerCert=*/false, /*checkPeerName=*/false);
+      ssl_ctx->setVerificationOption(
+          folly::SSLContext::SSLVerifyPeerEnum::NO_VERIFY);
+      // ALPN "rs" tells the server to route this TLS connection into the
+      // Rocket transport (matches `RocketOverSSLNoALPN` test pattern in
+      // pinned fbthrift v2026.01.05.00). Without ALPN, the server may
+      // reject the connection or fall back to the header-upgrade path.
+      ssl_ctx->setAdvertisedNextProtocols({"rs"});
+      folly::AsyncSSLSocket::UniquePtr ssl_sock(
+          new folly::AsyncSSLSocket(ssl_ctx, evb_));
+      // AsyncSSLSocket buffers writes until the TLS handshake completes,
+      // so RocketClientChannel's setup frame goes out only AFTER TLS is
+      // negotiated. Passing nullptr connect-callback is the canonical
+      // fbthrift pattern (see RocketOverSSLNoALPN in ThriftServerTest.cpp).
+      ssl_sock->connect(/*callback=*/nullptr, addr);
+      socket = std::move(ssl_sock);
+    } else {
+      socket.reset(new folly::AsyncSocket(evb_, addr));
+    }
     auto channel =
         apache::thrift::RocketClientChannel::newChannel(std::move(socket));
     if (use_zstd) {

packages/feedsim/third_party/src/workloads/ranking/mock_services/MockServiceMain.cc

@@ -21,6 +21,8 @@
 #include <glog/logging.h>
 
 #include <folly/init/Init.h>
+#include <folly/io/async/SSLContext.h>
+#include <wangle/ssl/SSLContextConfig.h>
 
 #include "thrift/lib/cpp2/server/ThriftServer.h"
 
@@ -72,11 +74,17 @@ DEFINE_int32(
     "for spin-wait jitter on requests whose modeled budget is already "
     "comparable to the natural RPC round trip.");
 
-// NOTE: TLS support intentionally not wired here. The open-source FBThrift
-// v2026.01.05.00 Rocket transport requires a fizz-based AsyncTransport (not
-// plain AsyncSSLSocket) on the client side; without it, TLS-REQUIRED servers
-// reject the first Rocket setup frame before SSL handshake even begins. See
-// the Encryption gap analysis in the t31 memo for the closure plan.
+// TLS knob. When --tls_cert and --tls_key are both set, the server requires
+// TLS on every inbound connection and advertises ALPN "rs" so RocketClient
+// transports can negotiate Rocket-over-TLS at handshake time (matches the
+// canonical pattern at thrift/lib/cpp2/test/server/ThriftServerTest.cpp
+// `RocketOverSSLNoALPN` in fbthrift v2026.01.05.00). Closes prod
+// multifeed/aggregator_main's Encryption CPU footprint (~3% on BGM).
+DEFINE_string(
+    tls_cert,
+    "",
+    "Path to TLS cert PEM. Empty disables TLS (plaintext sockets).");
+DEFINE_string(tls_key, "", "Path to TLS key PEM. Required when --tls_cert set.");
 
 int main(int argc, char** argv) {
   folly::Init init(&argc, &argv);
@@ -102,11 +110,31 @@ int main(int argc, char** argv) {
   server->setPort(FLAGS_port);
   server->setNumIOWorkerThreads(io_threads);
 
+  bool tls_enabled = false;
+  if (!FLAGS_tls_cert.empty() && !FLAGS_tls_key.empty()) {
+    auto sslCfg = std::make_shared<wangle::SSLContextConfig>();
+    sslCfg->setCertificate(FLAGS_tls_cert, FLAGS_tls_key, "");
+    sslCfg->clientVerification =
+        folly::SSLContext::VerifyClientCertificate::DO_NOT_REQUEST;
+    // Advertise ALPN "rs" so RocketClient transports negotiate
+    // Rocket-over-TLS in the handshake. Without this, REQUIRED servers
+    // can reject the connection or fall back to the header-upgrade path
+    // which never speaks Rocket on TLS.
+    sslCfg->setNextProtocols({"rs"});
+    server->setSSLConfig(sslCfg);
+    server->setSSLPolicy(apache::thrift::SSLPolicy::REQUIRED);
+    tls_enabled = true;
+  } else if (!FLAGS_tls_cert.empty() || !FLAGS_tls_key.empty()) {
+    LOG(ERROR) << "Both --tls_cert and --tls_key must be set together";
+    return EXIT_FAILURE;
+  }
+
   LOG(INFO) << "mock_services listening on port " << FLAGS_port
             << " with " << io_threads << " IO worker threads"
             << "; Silesia corpus from " << FLAGS_silesia_dir
             << " (" << silesia->numFiles() << " files, "
-            << (silesia->totalSize() / (1024 * 1024)) << " MB)";
+            << (silesia->totalSize() / (1024 * 1024)) << " MB)"
+            << "; tls=" << (tls_enabled ? "on" : "off");
 
   LOG(INFO) << "latency shaping: cap_us=" << FLAGS_latency_cap_us
             << " offset_us=" << FLAGS_latency_offset_us