The current checking always succeeded. We have to check the first
character of the string to check that it's empty, thus, skipping
the timeout path.

This fixes the use of the CT target without the timeout option.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>