A high-performance MQTT network Fuzzer.

This is an implementation of FUME-Fuzzing-MQTT-Brokers in Rust.

The Fuzzing process is based on a Markov Model seen in the following image: For more details see src/lib/lib.rs or the original paper.

Notable changes from the paper include:

• The use of multiple asynchronous threads for fuzzing by default
• Improved performance
• Only counting broker crashes as crashes(The original paper also counted refused connections as crashes)

After installing Rust, run the following command in the project directory:

cargo run -r -- --broker-command "YOUR_BROKER_START_COMMAND" fuzz

After fuzzing has found a crash you can run the following command to reproduce the crash:

cargo run -r -- --broker-command "YOUR_BROKER_START_COMMAND" replay

Note: DO NOT USE THIS ON A PRODUCTION SERVER AS IT MAY HAVE UNINTENDED SIDE EFFECTS

That being said, it works fine on my local machine. I recommend running the following commands before fuzzing to prevent the kernel from running out of ports:

sudo sysctl -w net.ipv4.tcp_fin_timeout=5
sudo sysctl -w net.ipv4.tcp_tw_reuse=1
sudo sysctl -w net.ipv4.ip_local_port_range="1024 65535"

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Currently, the Windows build is failing in the ci, however i've only tested this on Linux so far. Maybe it works on Windows, maybe it doesn't. I don't know. Pull Requests to fix this if necessary are welcome.

All bugs found with this software. If you find a bug using rusty-FUME, please open an issue and I'll add it to the list once it is patched.

• FlashMQ Null pointer dereference
• Data race in nanomq

• FUME: Fuzzing Message Queuing Telemetry Transport Brokers
• FUME-Fuzzing-MQTT-Brokers