cjdns: allow restricted direct-dns access (much less than e.g. abstractions/nameservice)