Is there a way to extend Net::FTP so that it uses IO::Socket::SSL instead of IO::Socket::INET as its base class?

You can subclass Net::FTP and override its port method to do what you want.

port() currently does the following:

sub port {
  @_ == 1 || @_ == 2 or croak 'usage: $ftp->port([PORT])';
  my ($ftp, $port) = @_;
  my $ok;
  delete ${*$ftp}{'net_ftp_intern_port'};
  unless (defined $port) {
    # create a Listen socket at same address as the command socket
    ${*$ftp}{'net_ftp_listen'} ||= IO::Socket::INET->new(
      Listen    => 5,
      Proto     => 'tcp',
      Timeout   => $ftp->timeout,
      LocalAddr => $ftp->sockhost,
    );
    my $listen = ${*$ftp}{'net_ftp_listen'};
    my ($myport, @myaddr) = 
     ($listen->sockport, split(/\./, $listen->sockhost));
    $port = join(',', @myaddr, $myport >> 8, $myport & 0xff);
    ${*$ftp}{'net_ftp_intern_port'} = 1;
  }
  $ok = $ftp->_PORT($port);
  ${*$ftp}{'net_ftp_port'} = $port;
  $ok;
}
[download]

In your subclass, implement port() so that it does everything exactly the same, but call IO::Socket::SSL->new() instead.

Update: Hmmm, actually that'll just SSLify the reverse connection back to the client (which won't even work because the server won't be expecting it ;).

You might be able to do something like:

BEGIN {
  use Net::FTP;
  use IO::Socket::SSL;
  @Net::FTP::ISA = 
    grep { $_ ne 'IO::Socket::INET' } 
      @Net::FTP::ISA;
  push @Net::FTP::ISA, 'IO::Socket::SSL';
}

my $ftp = Net:FTP->new(...); 
#etc
[download]

-David