Merge through r16884 from /nmap-exp/kris/nse-rawip plus the following changelog

entries:

o [NSE] Raw packet sending at the IP layer is now supported, in addition to
  the Ethernet sending functionality.  Packets to send start with an IPv4
  header and can be sent to arbitrary hosts. [Kris]

o [NSE] Added the ipidseq script to classify a host's IP ID sequence numbers
  in the same way Nmap does.  This can be used to test hosts' suitability for
  Nmap's Idle Scan (-sI), i.e. check if a host is an idle zombie.  This is
  the first script to use the new raw IP sending functionality in NSE. [Kris]

o [NSE] Added the function nmap.is_privileged() to tell a script if, as far
  as Nmap's concerned, it can do privileged operations.  For instance, this
  can be used to see if a script should be able to open a raw socket or
  Ethernet interface. [Kris]

o [NSE] Added the function nmap.get_ports() to allow a script to iterate
  over a host's port tables matching a certain protocol and state. [Kris,
  Patrick]

tcpip.cc

@@ -2835,6 +2835,37 @@ bool setTargetNextHopMAC(Target *target) {
   return false;
 }
 
+/* Like to getTargetNextHopMAC(), but for arbitrary hosts (not Targets) */
+bool getNextHopMAC(char *iface, u8 *srcmac, struct sockaddr_storage *srcss,
+		   struct sockaddr_storage *dstss, u8 *dstmac)
+{
+  arp_t *a;
+  struct arp_entry ae;
+
+  /* Nmap's ARP cache */
+  if (NmapArpCache(ARPCACHE_GET, dstss, dstmac))
+    return true;
+
+  /* System ARP cache */
+  a = arp_open();
+  addr_ston((sockaddr *) dstss, &ae.arp_pa);
+  if (arp_get(a, &ae) == 0) {
+    NmapArpCache(ARPCACHE_SET, dstss, ae.arp_ha.addr_eth.data);
+    memcpy(dstmac, ae.arp_ha.addr_eth.data, 6);
+    arp_close(a);
+    return true;
+  }
+  arp_close(a);
+
+  /* Send ARP */
+  if (doArp(iface, srcmac, srcss, dstss, dstmac)) {
+    NmapArpCache(ARPCACHE_SET, dstss, dstmac);
+    return true;
+  }
+
+  return false;
+}
+
 /* Set a pcap filter */
 void set_pcap_filter(const char *device, pcap_t *pd, const char *bpf, ...) {
   va_list ap;