CMAC is checked into upstream, release v4.6.2+:

> commit bf65e0f80fc0ac0349f888860035d7b95117df25
> Author: Alexander Scheel <ascheel@redhat.com>
> Date:   Wed Sep 25 12:09:06 2019 -0400
> 
>     Add tests for CMAC via JSS Provider
>     
>     These tests are from NIST's Examples with Intermediate Values page:
>     https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values
>     
>     Signed-off-by: Alexander Scheel <ascheel@redhat.com>
> 
> commit 69cefe1ef489ff498750fe78cb112c94ee5d85b5
> Author: Alexander Scheel <ascheel@redhat.com>
> Date:   Wed Sep 18 14:06:30 2019 -0400
> 
>     Add CMAC algorithm to JSSProvider
>     
>     CMAC is a form of MAC that utilizes a block cipher instead of a hash
>     function. Support for CMAC via PKCS#11 was recently introduced to NSS
>     allowing us to add support for it here.
>     
>     Related: https://bugzilla.mozilla.org/show_bug.cgi?id=1570501
>     
>     Signed-off-by: Alexander Scheel <ascheel@redhat.com>