curve25519: Reject all-zero shared secrets

While RFC 7748 states implementations MAY perform such a check, e.g.
TLS 1.3 explicitly requires it (RFC 8446, section 7.4.2).

Fixes: 7f9bfacd5a ("curve25519: Add a plugin providing Curve25519 DH using backend drivers")

src/libstrongswan/plugins/curve25519/curve25519_dh.c

@@ -120,12 +120,19 @@ METHOD(key_exchange_t, set_seed, bool,
 METHOD(key_exchange_t, get_shared_secret, bool,
 	private_curve25519_dh_t *this, chunk_t *secret)
 {
-	if (!this->computed &&
+	if (!this->computed)
-		!this->drv->curve25519(this->drv, this->pubkey, this->shared))
 	{
-		return FALSE;
+		if (!this->drv->curve25519(this->drv, this->pubkey, this->shared))
+		{
+			return FALSE;
+		}
+		if (memeq_const(this->shared, (u_char[CURVE25519_KEY_SIZE]){0},
+                        CURVE25519_KEY_SIZE))
+		{
+			return FALSE;
+		}
+		this->computed = TRUE;
 	}
-	this->computed = TRUE;
 	*secret = chunk_clone(chunk_from_thing(this->shared));
 	return TRUE;
 }