It's really completely in userspace and doesn't need any kernel modules or even superuser permissions for managing TUN/TAP devices (like e.g. OpenSSH's TUN device mode does)!

It uses a userspace TCP/IP stack by Google, as far as I understand.