setsockopt fails while kernel TLS option enabling - c

Question

I am learning about kernel TLS on kernel 5.3 version (Fedora 30 and 31) but stuck even on enabling ULP:
// tls.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/tls.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
int main() {
int sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock == -1) {
perror("socket creation");
exit (EXIT_FAILURE);
}
if (setsockopt(sock, SOL_TCP, TCP_ULP, "tls", sizeof("tls")) == -1 ) {
perror("tls init");
exit (EXIT_FAILURE);
}
close (sock);
return EXIT_SUCCESS;
}
Then:
$ cat /proc/sys/net/ipv4/tcp_available_ulp
tls
$ gcc tls.c -O0 -g
$ lsmod | grep tls
$ ./a.out
tls init: No such file or directory
$ lsmod | grep tls
$ sudo ./a.out
tls init: Unknown error 524
$ lsmod | grep tls
tls 57344 0
$ ./a.out
tls init: Unknown error 524
$
I don't know where I am wrong. It looks so simple in Kernel TLS docs:
Creating a TLS connection
First create a new TCP socket and set the TLS ULP.
sock = socket(AF_INET, SOCK_STREAM, 0);
setsockopt(sock, SOL_TCP, TCP_ULP, "tls", sizeof("tls"));
Setting the TLS ULP allows us to set/get TLS socket options. Currently
only the symmetric encryption is handled in the kernel. After the TLS
handshake is complete, we have all the parameters required to move the
data-path to the kernel. There is a separate socket option for moving
the transmit and the receive into the kernel.
I don't understand how I can enable in kernel TLS and what I am doing wrong.