Which is to say, you turn on IP forwarding by default (which is illegal) and rewrite the packet source headers on the way in and out (which is also illegal).

Writing a socks client that hooks to a tunnel driver on the machine that needs the masquerading is a better solution, and it doesn't require kernel hacks to get there (or source hacks for statically linked binaries, like normal socks does). And it does it without violating the world.

I guess you would need to write a tunnel client daemon (instead of putting in about twice as much work to write IP masquerading, as well as dragging the poor kernel into the mess).

Seems like that would provide the same capability for less effort with fewer drabacks -- but would require an OS (like FreeBSD) with tunnel drivers to make it work.