Re-imaging the same PC: clear its stale SMB/conntrack state every time

A PC whose imaging failed and is re-imaged gets the same IP, and the
server still held state from the dead run, so net use failed (System
error 53). The April fix (18537ac) did not cover it:

- The dnsmasq hook only acted on 'add'/'del'. A re-image comes back to the
  existing lease, which dnsmasq reports as 'old', and only when the
  hostname/MAC changed. Now dnsmasq sets script-on-renewal, and the hook
  clears state on 'old' when the request comes from PXE firmware or iPXE
  (vendor class PXEClient), i.e. the machine just network-booted. A
  Windows lease renewal (MSFT 5.0) is left alone.
- The 1 h conntrack timeout never applied after a reboot: systemd-sysctl
  runs before ufw loads nf_conntrack, so the keys did not exist and the
  5-day default stayed. /etc/modules-load.d/pxe-conntrack.conf loads it
  first.
- smb-soft-reset.sh flushed neighbours on br-pxe, which no longer exists.

Live 2026-10-14. Hook tested on the server with an unused IP: network-boot
renewal clears, Windows renewal and no vendor class do not, add clears.

playbook/pxe-server-helpers/pxe-dhcp-hook.sh

@@ -14,6 +14,14 @@
 #   $3 = client IP
 #   $4 = hostname (may be empty)
 #
+# A re-image usually comes back to the SAME lease (same MAC, same IP), which
+# dnsmasq reports as "old", not "add" - and only at all because dnsmasq.conf
+# sets script-on-renewal. "old" also fires when a running Windows PC renews
+# its lease, so on "old" we only clear state when the request came from PXE
+# firmware or iPXE (vendor class PXEClient...): that machine has just
+# rebooted into a network boot, so any server-side session for its IP is
+# dead. A renewal from Windows (vendor class "MSFT 5.0") is left alone.
+#
 # Must exit quickly; dnsmasq waits for it. Logs to syslog via logger.
 
 set +e
@@ -25,13 +33,22 @@ host="${4:-}"
 
 [ -z "$ip" ] && exit 0
 
+clear_state() {
+    /usr/sbin/conntrack -D -s "$ip" >/dev/null 2>&1
+    /usr/sbin/conntrack -D -d "$ip" >/dev/null 2>&1
+    /usr/bin/ss -K "dst = $ip"  >/dev/null 2>&1
+    /usr/bin/ss -K "src = $ip"  >/dev/null 2>&1
+    logger -t pxe-dhcp-hook "cleared stale state for $1 $ip ($mac${host:+ $host})"
+}
+
 case "$action" in
     add|del)
-        /usr/sbin/conntrack -D -s "$ip" >/dev/null 2>&1
-        /usr/sbin/conntrack -D -d "$ip" >/dev/null 2>&1
-        /usr/bin/ss -K "dst = $ip"  >/dev/null 2>&1
-        /usr/bin/ss -K "src = $ip"  >/dev/null 2>&1
-        logger -t pxe-dhcp-hook "cleared stale state for $action $ip ($mac${host:+ $host})"
+        clear_state "$action"
+        ;;
+    old)
+        case "${DNSMASQ_VENDOR_CLASS:-}" in
+            PXEClient*) clear_state "old (network boot, ${DNSMASQ_VENDOR_CLASS%%:UNDI*})" ;;
+        esac
         ;;
 esac