xt_bpf extension can be used to access auxiliary packet data, such as payload length. The
xt_u32 extension can do it to some extent as well. I know that nftables supports a length meta selector, but the raw payload expression only supports fixed offsets or the base of layer 2, 3, or 4 headers. Is there any way to perform a match at a variable offset, for example to match SNI, using only nftables? As this is an embedded system with extremely limited resources, it isn't ideal to use both nftables and iptables simultaneously.
I would rather not use
libnetfilter_queue or anything else which passes the decision making to userland, if possible. The filtering should occur entirely within the kernel.