Attaching to TCX Ingress/Egress makes the BPF program run on both ends for some reason?

[viktordoronin]

Hello there.
BPF code is simple:

SEC("tcx/egress")
int egress_test(struct __sk_buff *skb){
  bpf_printk("Hello world!");
  return 0;
}

It just prints a message every time a program fires.
Go code:

func main(){
	//check if we have root
	if usr,_:=user.Current();usr.Uid!="0" {
		log.Fatalf("Forgot sudo, dumbass")
	}
	
	// Load the compiled eBPF ELF and load it into the kernel.
	var objs senderObjects
	var opts = ebpf.CollectionOptions{Programs:ebpf.ProgramOptions{LogLevel:1}}
	if err := loadSenderObjects(&objs, &opts); err != nil {
		var verr *ebpf.VerifierError
		if errors.As(err, &verr) {
			log.Fatalf("Verifier error: %+v\n", verr) 
		}
		log.Fatalf("Error loading programs: %v",err)
		} else {
		log.Print("All programs successfully loaded and verified")
		log.Print(objs.SenderOut.VerifierLog)
	}
	defer objs.Close()
	
	iface, err := net.InterfaceByName("lo")
	if err!=nil{
		log.Fatalf("Could not get interface: %v",err)
	}

	tcxopts:=link.TCXOptions{
		Interface: iface.Index,
		Program: objs.EgressTest,
		Attach: ebpf.AttachTCXEgress,
	}
	l_out,err:=link.AttachTCX(tcxopts)
	if err!=nil{
		log.Fatalf("Error attaching the egress program: %v",err)
	}
	defer l_out.Close()

	//packet emission
	localaddr:=net.UDPAddr{
		IP:net.ParseIP("127.0.0.1"),
		Port: 833,
	}
	remoteaddr:=net.UDPAddr{
		IP:net.ParseIP("127.0.0.1"),
		Port: 862,
	}
	conn, err:=net.DialUDP("udp",&localaddr,&remoteaddr)
	if err!=nil{
		log.Fatalf("Error connecting: ",err)
	}

	go func(){
		net.ListenUDP("udp",&localaddr)
		for{}
	}()
	
	mypacket:=senderpacket{
		Seq: 1,
		Ts_s: 0,
		Ts_f: 0,
	}
	var buff = make([]byte,44)
	_,err=binary.Encode(buff,binary.BigEndian,mypacket)
	if err!=nil{
		log.Fatalf("Encode error:",err)
	}
	
	conn.Write(buff)
	log.Print("(presumably) sent a packet...")

The BPF program loads and verifies as expected, I can see the packet in Wireshark and it looks as expected. Problem: upon checking the tracepipe, I see the "Hello world" message twice per sent packet. Which means the BPF program, supposedly attached to egress, fires twice. Which means it fires on both ingress and egress. I tried switching the program and attaching to ingress instead - it produces the same behaviour. I've consulted the docs and TCX example and I don't think I've done anything wrong. This is executed on a VM so there's no other traffic going on.
Any ideas?

[viktordoronin]

Turns out it doesn't happen on actual network interfaces, just loopback. Not sure why, but I don't care too much.