Is there any stateful user-space firewall for Linux? I'm looking for a firewall that doesn't rely on anything in Linux kernel (like iptables/netfilter) and works with raw packets.
iptables will allow you to route selected packets to usespace for additional processing. (In your case selected packets would possibly mean all packets.) I've not done this but
man iptables has this to say on the matter:
ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE means to pass the packet to userspace. (How the packet can be received by a userspace process differs by the particular queue handler. 2.4.x and 2.6.x kernels up to 2.6.13 include the ip_queue queue handler. Kernels 2.6.14 and later additionally include the nfnetlink_queue queue handler. Packets with a target of QUEUE will be sent to queue number '0' in this case. Please also see the NFQUEUE target as described later in this man page.)
NFQUEUE [...] is an extension of the QUEUE target. As opposed to QUEUE, it allows you to put a packet into any specific queue, identified by its 16-bit queue number. [...] it requires the nfnetlink_queue kernel support.
Of course, this doesn't give you stateful firewall support but at least you can get at the packets. This also uses
iptables to get the packets out to you in the first place, which may be unacceptable.