The other thing worthy of note is that it appears every single packet will need to be processed through this application; necessary for it to do its job, but will likely have a significant effect on performance.
No, only the initial connection requests will go into the netfilter queue (as well as DNS requests so that it knows what a particular IP actually refers to). Packets sent as part of a connection aren't vetted, and it uses the marking feature of netfilter so all of the actual filtering is done by the kernel.
I'm surprised, I expected this to be an iptables frontend.
The used technique, redirecting initial packets to a netfilter queue and then marking the connection to offload further processing to the kernel seems like a reasonable way to do this from userspace.
netfilter is the underlying kernel infrastructure, that's used e.g. by iptables to set rules for packets. From this https://github.com/evilsocket/opensnitch/blob/master/opensni..., it looks like OpenSnitch uses iptables to set rules so that the kernel delivers outgoing packets that don't belong to an existing connection to a queue. It then can use said queue to only intercept those packets – if it lets them pass, a connection will be created and further packets will not be passed to/handled by OpenSnitch. It touches the first packet of each outgoing connection, but not all traffic.
Unless you were planning to use Ragel.
The performance of this Python implementation will be interesting to watch.