What would it take to have a TUN-less client that exposes the VPN connection as a SOCKS proxy? The use case I'm imagining is being able to sit down at a machine as an unprivileged user, connect to a VPN, then run Firefox Portable and have all traffic from the browser go through the VPN, all without having to install anything.