fix(ngap): guard nil GNbId and missing targetRan in UplinkRANConfigurationTransfer

[neelareddybollu]

Summary

Fixes free5gc/free5gc#1049 — nil pointer dereference in the AMF NGAP handler for UplinkRANConfigurationTransfer.

Root Cause

The function handleUplinkRANConfigurationTransferMain contained two bugs:

Bug 1 — nil dereference on GNbId (line 1914)

ngapConvert.RanIdToModels() only sets ranId.GNbId when the incoming
GlobalRANNodeID carries a global gNB-ID (GlobalRANNodeIDPresentGlobalGNBID).
For any other node type — globalN3IWF-ID, globalNgENB-ID, globalTNGF-ID,
globalTWIF-ID, globalWAGF-ID — the field is left nil.

The handler then unconditionally accessed targetRanNodeID.GNbId.GNBValue,
causing a nil-pointer dereference panic.

// BEFORE (panics when GNbId is nil)
if targetRanNodeID.GNbId.GNBValue != "" {
    ran.Log.Tracef("targerRanID [%s]", targetRanNodeID.GNbId.GNBValue)
}

// AFTER
if targetRanNodeID.GNbId != nil && targetRanNodeID.GNbId.GNBValue != "" {
    ran.Log.Tracef("targerRanID [%s]", targetRanNodeID.GNbId.GNBValue)
}

Bug 2 — nil targetRan passed to SendDownlinkRanConfigurationTransfer

When AmfRanFindByRanID returns ok = false, targetRan is nil. The previous
code logged a warning but continued to call
SendDownlinkRanConfigurationTransfer(targetRan, ...) with the nil pointer,
risking a secondary panic inside that function.

// BEFORE
targetRan, ok := aMFSelf.AmfRanFindByRanID(targetRanNodeID)
if !ok {
    ran.Log.Warn("targetRan is nil")
}
ngap_message.SendDownlinkRanConfigurationTransfer(targetRan, sONConfigurationTransferUL)

// AFTER
targetRan, ok := aMFSelf.AmfRanFindByRanID(targetRanNodeID)
if !ok {
    ran.Log.Warn("targetRan not found, dropping SONConfigurationTransfer")
    return
}
ngap_message.SendDownlinkRanConfigurationTransfer(targetRan, sONConfigurationTransferUL)

How to Reproduce

Send a crafted NGAP UplinkRANConfigurationTransfer message where
TargetRANNodeID.GlobalRANNodeID uses a non-gNB node type
(e.g. globalN3IWF-ID), or a valid gNB ID that does not match any known RAN.
The AMF process panics immediately.

Changes

• internal/ngap/handler.go: Add GNbId != nil guard before accessing
  GNbId.GNBValue; add early return when targetRan is not found.

[neelareddybollu]

Hi maintainers, just following up on this PR — happy to rebase, squash, or address any review feedback if needed. The two nil-dereference guards in the NGAP UplinkRANConfigurationTransfer handler (GNbId check + missing targetRan lookup) are still relevant and fix the panic described in free5gc/free5gc#1049. Let me know if there’s anything blocking merge. Thanks for your time!

[roundspring2003]

@Alonza0314 Test all pass

[Alonza0314]

Hi @neelareddybollu ,
Thanks for your contribution. As your PR has been merged, don't forget to update your account in the contributor list at here.

Thanks again for your contribution.