I haven't used it, but the QUEUE netfilter target looks like it might work. It uses an nflink socket and a userspace application registered to the socket to perform the payload modifications.
The libipq man page contains details on how to use this and provides a simple example.
