diff --git a/src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java b/src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java
index 98a913e..b542410 100644
--- a/src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java
+++ b/src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java
@@ -41,6 +41,7 @@ public class IpWhitelistController {
         return ApiResponse.success("删除成功");
     }
 
+    //todo 要么分页写到@RequestParam,要么改用post
     @GetMapping("/page")
     @Operation(summary = "分页查询IP白名单", description = "支持分页查询IP白名单列表")
     public ApiResponse<IPage<IpWhitelistResponse>> getWhitelistPage(@RequestBody IpWhitelistRequest req) {
diff --git a/src/main/java/com/cisd/tms/modules/device/filter/IpWhitelistFilter.java b/src/main/java/com/cisd/tms/modules/device/filter/IpWhitelistFilter.java
index 45ac136..66aeb2f 100644
--- a/src/main/java/com/cisd/tms/modules/device/filter/IpWhitelistFilter.java
+++ b/src/main/java/com/cisd/tms/modules/device/filter/IpWhitelistFilter.java
@@ -86,6 +86,7 @@ public class IpWhitelistFilter implements Filter {
     }
 
     private String getClientIp(HttpServletRequest request) {
+        //todo 这几个header获取的ip可能是客户端伪造的
         String[] headers = {
                 "X-Forwarded-For",
                 "Proxy-Client-IP",
diff --git a/src/main/java/com/cisd/tms/modules/device/service/NetworkConfigService.java b/src/main/java/com/cisd/tms/modules/device/service/NetworkConfigService.java
index 1d32dd9..8d57c3c 100644
--- a/src/main/java/com/cisd/tms/modules/device/service/NetworkConfigService.java
+++ b/src/main/java/com/cisd/tms/modules/device/service/NetworkConfigService.java
@@ -184,7 +184,7 @@ public class NetworkConfigService {
 
 
         String cidr = req.getIpv4() + "/" + maskLength;
-
+        //todo 这里需要判断hasGateway是否为true，再确定命令是否有 ipv4.gateway。
         try {
             executeCommand("nmcli", "con", "mod", connectionName,
                     "ipv4.method", "manual",
@@ -411,7 +411,9 @@ public class NetworkConfigService {
         return "Bond [" + bondName + "] 删除成功";
     }
 
-
+    //todo
+    //这里是先删除物理网卡再添加bond，如果添加失败，那么之前删除的不可逆
+    //建议对添加的bondname和slaveList做存在性校验，再执行添加。 或者记录已删除连接 UUID/名称，失败后回滚。
     public String addSlavesTOBond(BondAddSlavesRequest req) {
         String bondName = req.getBondName();
         List<String> slaves = req.getSlaveList();
@@ -779,7 +781,7 @@ public class NetworkConfigService {
         String targetCidr = req.getTargetCidr();
         String nextHop = req.getNextHop();
 
-
+        //todo 对gatewayIp、targetCidr、nextHop增加格式校验。可用正则表达式
         if (deviceName == null || deviceName.trim().isEmpty()) {
             throw new IllegalArgumentException("网卡名称不能为空");
         }
diff --git a/src/main/java/com/cisd/tms/modules/device/service/impl/TimeConfigServiceImpl.java b/src/main/java/com/cisd/tms/modules/device/service/impl/TimeConfigServiceImpl.java
index 4b94f48..ab35815 100644
--- a/src/main/java/com/cisd/tms/modules/device/service/impl/TimeConfigServiceImpl.java
+++ b/src/main/java/com/cisd/tms/modules/device/service/impl/TimeConfigServiceImpl.java
@@ -25,12 +25,14 @@ public class TimeConfigServiceImpl implements TimeConfigService {
             }
 
             String datetime = request.getDatetime();
+            //todo 建议用LocalDateTime进行校验格式
             if (datetime == null || !datetime.matches("^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}$")) {
                 throw new IllegalArgumentException("Invalid or empty datetime format. Expected: YYYY-MM-DD HH:MM");
             }
 
             executeCommand("timedatectl set-timezone " + request.getTimezone().trim());
             executeCommand("systemctl stop chronyd");
+            //todo 失败后重启chronyd
             executeCommand("date -s '" + request.getDatetime() + "'");
 
         } else if ("NTP".equalsIgnoreCase(mode)) {
@@ -39,7 +41,7 @@ public class TimeConfigServiceImpl implements TimeConfigService {
             if (servers == null || servers.isEmpty()) {
                 throw new IllegalArgumentException("At least one NTP server IP must be provided in NTP mode");
             }
-
+            //todo 参数校验SyncInterval:限制正数、范围或 2 的幂
             int interval = request.getSyncInterval() != null ? request.getSyncInterval() : 600;
             int pollExp = (int) Math.round(Math.log(interval) / Math.log(2));
             StringBuilder serverConfLines = new StringBuilder();
@@ -60,6 +62,7 @@ public class TimeConfigServiceImpl implements TimeConfigService {
                     "driftfile /var/lib/chrony/drift\\n" +
                     "makestep 1.0 3\\n" +
                     "rtcsync\\n";
+            //todo 这里直接重写配置文件，如果失败则原配置丢失。建议备份，失败后回滚。
             executeCommand("echo -e '" + confContent + "' > /etc/chrony.conf");
             executeCommand("systemctl restart chronyd");
             executeCommand("chronyc -a makestep");